Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · CopyKittens · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

CopyKittens

  • Slayer Kitten
  • G0052

state sponsor · Iran (Islamic Republic of)MITRE G0052 ↗

CopyKittens — ATT&CK roseCO

attack rose · 8 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.

Observed targets (as stated by the sources)

5 countries · 3 sectors
IsraelJordanSaudi ArabiaGermanyUnited StatesAssessed origin: Iran

assessed origin · Iranobserved targets · 5

countries · 5

  • Israel
  • Jordan
  • Saudi Arabia
  • Germany
  • United States

sectors · 3

  • Government
  • Private sector
  • Civil society

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

8 techniques · 6 of 15 tactics

  1. Resource development

    1 technique

  2. Execution

    1 technique

  3. Stealth

    2 techniques

  4. Defense impairment

    1 technique

  5. Collection

    2 techniques

  6. Command and control

    1 technique

select a technique

Arsenal

3 malware · 1 tools
Malware
Malware · 3ATT&CK
Cobalt StrikeS0154 ↗
TDTESSS0164 ↗
MatryoshkaS0167 ↗
Tools
Tools · 1ATT&CK
EmpireS0363 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

10 sources
  1. 1.s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf
  2. 2.domaintools.com/resources/blog/case-study-hunting-campaign-indicators-…
  3. 3.clearskysec.com/copykitten-jpost
  4. 4.clearskysec.com/tulip
  5. 5.cfr.org/interactive/cyber-operations/copykittens
  6. 6.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
  7. 7.attack.mitre.org/groups/G0052
  8. 8.attack.mitre.org/groups/G0052
  9. 9.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
  10. 10.cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf

Track CopyKittens on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.