Forensia CTI Core

Profile

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.

MITRE ATT&CK ↗

Techniques

8 ATT&CK techniques attributed to this actor.

T1059.001 PowerShell T1090 Proxy T1218.011 Rundll32 T1553.002 Code Signing T1560.001 Archive via Utility T1560.003 Archive via Custom Method T1564.003 Hidden Window T1588.002 Tool

Software

4 malware/tools attributed to this actor.

Cobalt StrikeTDTESSMatryoshkaEmpire

Related corpus activity

8,147 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to CopyKittens.

Indicator	Type	Family	Sev	Src
cve-2025-2492	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2020-22658	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2026-22584	cve	—	85	2
cve-2025-66478	cve	—	85	2
cve-2013-3307	cve	—	85	2
cve-2018-8007	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2017-17215	cve	—	85	2
cve-2023-44976	cve	ransomware	85	2
cve-2024-1781	cve	—	85	1
cve-2025-68670	cve	—	85	2
cve-2016-5681	cve	—	85	2
cve-2025-23304	cve	—	85	2
82e579bd49d69845133c9aa8585f8bd26736437b	hash	—	80	2
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb	sha256	—	80	1
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
03b51af0a04467cebfa235199db4c02e	hash	wallet_compromise	80	1
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5ca	sha256	phishing	80	2
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
d35695f2366a43628231e73ffa83ca106306a8fa	hash	—	80	2
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525	sha256	phishing	80	2
669002654c264191d4660fbf757860d930175649735f81370b9f1af3658a304c	sha256	phishing	80	2
f96bcd875836da89800912de1e557891697c7cf4	hash	—	80	2
fe0161fb8a26a0bf4afad746c7ebf89499dcd3a7	hash	—	80	2
7105caa6d4fd8a2c67523d385277528e556ae4f6	hash	—	80	2
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1

Showing the top 30 by severity of 8,147.