CopyKittens Cluster

CopyKittens is an Iranian cyber espionage cluster active from at least 2013 through 2017, named by ClearSky Cyber Security and Trend Micro based on the group's practice of repurposing and adapting publicly known offensive tools — effectively "copying" techniques from other actors. The group was among the earlier documented Iranian APT clusters and focused primarily on intelligence collection from government, military, academic, and IT sector targets.

Targets and Goals

CopyKittens targeted organizations in Israel, Germany, the United States, Saudi Arabia, Turkey, and Jordan. Primary victims included government ministries, defense-adjacent organizations, academic institutions, and IT companies. The group showed particular interest in targets connected to Middle Eastern geopolitics, consistent with Iranian state intelligence priorities. One notable campaign — Operation Electric Powder — targeted employees of the Israel Electric Corporation using fake social media personas.

Tooling and Tactics

The group used a combination of custom and adapted tools. Its signature framework was Matryoshka, a modular remote access trojan that communicated over HTTP. CopyKittens also used watering hole attacks, spear phishing with malicious documents, and exploitation of public-facing web applications for initial access. The group repurposed components from publicly available offensive tools and open-source projects, adapting them to its own campaigns — a pattern that gave rise to the "CopyKittens" name.

Current Status

After 2017, public reporting on CopyKittens activity dropped significantly. The cluster is now considered largely dormant or absorbed into broader Iranian operational structures. Its documented TTPs and targeting patterns share characteristics with other contemporaneous Iranian groups including OilRig and Charming Kitten.