CopyKittens is an Iranian cyber-espionage group active since at least 2013, documented by ClearSky and Trend Micro for Operation Wilted Tulip — a long-running campaign against government, defense, academic, and media targets in Israel, Saudi Arabia, Jordan, and Turkey using self-developed tools and website compromises.
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
CopyKittens was first reported by ClearSky in 2015 and detailed jointly with Trend Micro in the July 2017 'Operation Wilted Tulip' report. MITRE tracks it as G0052. The group earned its name from a habit of copying and repurposing publicly available code rather than developing highly novel malware, and is assessed with medium-high confidence as Iranian state-aligned based on victimology and infrastructure.
Operationally CopyKittens relied on spearphishing, strategic web compromises/watering holes on legitimate news and organizational sites, DNS-based data exfiltration, and a custom toolset including the TDTESS backdoor, Vminst, NanoCore, and the Matryoshka RAT, alongside Cobalt Strike and Metasploit. Its exfiltration via DNS and use of compromised trusted websites for delivery gave it a moderately stealthy footprint against under-defended regional targets.
MENA targeting is central: victims included Israeli government institutions, defense companies, subcontractors, academic researchers, and IT firms, plus government and diplomatic targets in Saudi Arabia, Jordan, and Turkey (and further afield in the U.S. and Germany). Operation Wilted Tulip specifically documented the compromise of the Jerusalem Post and other regional media for watering-hole delivery.
Distinct CopyKittens-branded reporting tapered after 2017, and the group is assessed as dormant under this name; its operators and tooling overlap with the broader Iranian espionage ecosystem. It is included as a mid-2010s Iranian historical entry.