MITRE ATT&CKgroup
G0052 CopyKittens
- Domain
- enterprise
- Version
- 1.6
- Created
- 2018-01-16
Description
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.
Related
Uses · MITRE ATT&CK (12)
- T1588.002 Tool sub-technique
- T1564.003 Hidden Window sub-technique
- T1059.001 PowerShell sub-technique
- T1560.001 Archive via Utility sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1553.002 Code Signing sub-technique
- T1218.011 Rundll32 sub-technique
- S0363 Empire software (tool)
- S0164 TDTESS software (malware)
- S0167 Matryoshka software (malware)
- S0154 Cobalt Strike software (malware)
- T1090 Proxy technique
References
- http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf ClearSky Wilted Tulip July 2017
- http://www.clearskysec.com/copykitten-jpost/ ClearSky CopyKittens March 2017
- https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf CopyKittens Nov 2015