CopyKittens
- ID
- G0052
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.[1][2][3]
Techniques used (8)
- T1059.001 PowerShell
- T1090 Proxy
- T1218.011 Rundll32
- T1553.002 Code Signing
- T1560.001 Archive via Utility
- T1560.003 Archive via Custom Method
- T1564.003 Hidden Window
- T1588.002 Tool