IRIran (Islamic Republic of)confidence: 50G0052
CopyKittensCopyKittens
Also known as: Slayer Kitten · G0052 · CopyKittens
Origin
IR
Known aliases
3
Target sectors
3
Attribution
State-sponsored
Profile
CopyKittens is a Iranian-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). The group is also tracked as Slayer Kitten, G0052. Operational targeting focuses on the Government, Private sector, and Civil society sectors. Documented victim organisations include Israel, Jordan, Saudi Arabia and 2 other named victims.
Aliases· 3
Slayer KittenCopyKittens
Target sectors· 3
GovernmentPrivate sectorCivil society
Known victims· 5
- Israel
- Jordan
- Saudi Arabia
- Germany
- United States
MITRE ATT&CK Group crosswalk
References
- https://s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf
- https://www.domaintools.com/resources/blog/case-study-hunting-campaign-indicators-on-privacy-protected-attack-infrastr
- http://www.clearskysec.com/copykitten-jpost/
- http://www.clearskysec.com/tulip/
- https://www.cfr.org/interactive/cyber-operations/copykittens
- https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
- https://attack.mitre.org/groups/G0052/
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.