Home / Threat actors / CopyKittens
CopyKittens G0052
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
8
Techniques
4
Malware and tools
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1588.002 Tool Execution
T1059.001 PowerShell Stealth
T1218.011 Rundll32T1564.003 Hidden Window Defense Impairment
T1553.002 Code Signing Collection
T1560.001 Archive via UtilityT1560.003 Archive via Custom Method Command and Control
T1090 Proxy Malware and tools
- Cobalt StrikeMalwareS0154
- MatryoshkaMalwareS0167
- TDTESSMalwareS0164
- EmpireToolS0363
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.