CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.123
- ClearSky CopyKittens March 2017
- ClearSky Wilted Tulip July 2017
- CopyKittens Nov 2015
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1560.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1059.001 | PowerShell | — |
| T1090 | Proxy | — |
| T1218.011 | Rundll32 | — |
| T1553.002 | Code Signing | — |
| T1560.001 | Archive via Utility | — |
| T1560.003 | Archive via Custom Method | — |
| T1564.003 | Hidden Window | — |
| T1588.002 | Tool | — |
Aliases
CopyKittens
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.