Actors Insights|Latest update04/07/2026

CopyKittens

Named by Trend MicroSuspected state sponsor: Islamic Republic of Iran

CopyKittens is an Iranian state-linked cyber espionage group active since at least 2013, first named by ClearSky Cyber Security and Trend Micro. The group conducted targeted intrusion campaigns against government, defense, academic, and IT organizations in Israel, Germany, the United States, Saudi Arabia, Turkey, and Jordan. CopyKittens is known for deploying the Matryoshka malware framework and using watering hole attacks, spear phishing, and web application exploitation for initial access. The group's activity largely ceased after 2017 in public reporting, though its TTPs and targeting profile overlap with broader Iranian state espionage operations of the same period.

First Seen:Jan 2013
Last Seen:Jul 2017
Indexed Reports:4
Public IOCs:319
Cluster: CopyKittensMitre: CopyKittensMisp: CopyKittens
also known as:
Slayer Kitten (CrowdStrike)G0052 (Mitre)CopyKittens (Trend Micro)

Targeted Regions

Germany
DE
Germany
Germany
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Israel
IL
Israel
Israel
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Mar 2015 ~ Nov 2015
Jan 2013 ~ Jul 2017
Mar 2015 ~ Nov 2015
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Sep 2016 ~ Mar 2017
Oct 2016 ~ Jan 2017
Jan 2013 ~ Jul 2017
Sep 2016 ~ Mar 2017
Jordan
JO
Jordan
Jordan
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Palestine
PS
Palestine
Palestine
Oct 2016 ~ Jan 2017
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Turkey
TR
Turkey
Turkey
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
United States
US
United States
United States
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013 ~ Jul 2017
Jan 2013Jun 2026

Targeted Sectors

Government Agencies and ServicesMediaUniversityDefenseInformation TechnologyHealthcare

Recent Indexed Reports

  1. Public
    CopyKittens: Espionage Campaign Targeting Strategic Sectors Across the Globe
  2. Public
    CopyKittens Targets Israeli Media and Palestinian Healthcare in Watering Hole Attacks
  3. Public
    CopyKitten’s Spearphishing Attack on Israeli Ministry of Communications
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.