- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- Iran (Islamic Republic of)
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0052 · 8 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0060 · copykittens
IranWhat it is
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- CopyKittens, Slayer Kitten, Slayer Kitten
- Microsoft
- DEV-0588
- MITRE ATT&CK
- G0052
- Operations
- Operation “Wilted Tulip”
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Germany, Israel, Jordan, Saudi Arabia, Türkiye, United States
- Sectors
- Civil society, Defense, Education, Government, IT, Media, Private sector
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Empire
- EmpireProject
- Matryoshka
- Matryoshka RAT
- Sky Wyder
- TDTESS
- Vminst
- ZPP
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de