← All Threat Actors
Threat Actor Profile

CopyKittens

G0052 Slayer Kitten
▲ High Threat
[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)
Origin Iran
Sponsor Iran (Islamic Republic of)
Motivation Espionage

Target Sectors

Government Private sector Civil society

Known TTPs

Archive via Custom Method
Archive via Utility
PowerShell
Proxy
Rundll32
Hidden Window
Tool
Code Signing

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD