CopyKittens

🔴 High
Also known as: CopyKittens, DEV-0588, G0052, Operation “Wilted Tulip”, Slayer Kitten

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. ClearSky CopyKittens March 2017 ClearSky Wilted Tulip July 2017 CopyKittens Nov 2015

🌍 Country Iran
📅 Activity 2017 — 2017
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0052
Government Private sector Civil society
2017
2017

Targeted Victims

Israel Jordan Saudi Arabia Germany United States

Associated Operations

2013 2015 2017-01 As part of our monitoring of Iranian threat agents activities Breach of the Israeli newspaper Jerusalem Post CopyKittens has conducted at least three waves of cyber-attacks in the past year. In each of the attacks the infection method was almost identical and included an extraordinary number of stages used to avoid detection. As with other common threat actors In this report Operation “Wilted Tulip” Trend Micro and ClearSky expose a vast espionage apparatus spanning the entire time the group has been active. It includes recent incidents as well as older ones that have not been publicly reported and the group’s modus operandi. We dubbed this activity Operation Wilted Tulip. as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens. delivery and command and control infrastructure exploitation https://s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf https://www.clearskysec.com/copykitten-jpost/ https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf new malware the Jerusalem Post the group relies on social engineering methods to deceive its targets prior to infection. we have detected that since October 2016 and until the end of January 2017

Introduction

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. ClearSky CopyKittens March 2017 ClearSky Wilted Tulip July 2017 CopyKittens Nov 2015

Activities and Tactics

Targeted Sectors: Government, Private sector, Civil society

Country of Origin: 🇮🇷 Iran

Risk Level: High

First Seen: 2017

Last Activity: 2017

Incident Type: Espionage

Suspected Victims: Israel, Jordan, Saudi Arabia, Germany, United States

Notable Campaigns

  • 2013
  • 2015
  • 2017-01
  • As part of our monitoring of Iranian threat agents activities
  • Breach of the Israeli newspaper Jerusalem Post
  • CopyKittens has conducted at least three waves of cyber-attacks in the past year. In each of the attacks the infection method was almost identical and included an extraordinary number of stages used to avoid detection. As with other common threat actors
  • In this report
  • Operation “Wilted Tulip”
  • Trend Micro and ClearSky expose a vast espionage apparatus spanning the entire time the group has been active. It includes recent incidents as well as older ones that have not been publicly reported
  • and the group’s modus operandi. We dubbed this activity Operation Wilted Tulip.
  • as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens.
  • delivery and command and control infrastructure
  • exploitation
  • https://s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf
  • https://www.clearskysec.com/copykitten-jpost/
  • https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
  • new malware
  • the Jerusalem Post
  • the group relies on social engineering methods to deceive its targets prior to infection.
  • we have detected that since October 2016 and until the end of January 2017

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • CyberGate:
  • Arabian-Attacker RAT:
  • Cyber Eye RAT:
  • Sky Wyder:
  • Cobalt Strike:
  • EmpireProject:
  • Matryoshka RAT:
  • TDTESS:
  • Vminst:
  • ZPP:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] ClearSky Wilted Tulip July 2017 ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017. [4] ClearSky CopyKittens March 2017 ClearSky Cyber Security. (2017, March 30). Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten. Retrieved August 21, 2017. [5] CopyKittens Nov 2015 Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.