Threats Feed

Operation Wilted Tulip, jointly published by ClearSky and Trend Micro in July 2017, exposes CopyKittens' full espionage apparatus active since 2013. The group targeted government institutions (including Ministries of Foreign Affairs), academic institutions, defense companies, IT companies, and media outlets across Israel, Saudi Arabia, Turkey, the US, Jordan, and Germany — with UN employees also targeted. Five delivery methods were documented: watering hole attacks inserting BeEF (Browser Exploitation Framework) JavaScript into breached news websites (Jerusalem Post, Maariv, IDF Disabled Veterans Organization); web-based exploitation using browser fingerprinting code served from attacker-built sites after compromising email accounts at target organizations; malicious documents exploiting CVE-2017-0199 (Word/HTA RCE), embedding OLE objects with RTLO (right-to-left override) extension spoofing, and macro-based execution; fake Facebook profiles and a fake Israeli news aggregator ("Emet press," built on NovinWebGostar — an Iranian web development platform) to build target trust; and SQL injection via Havij, sqlmap, and Acunetix against internet-facing web servers. Custom malware included TDTESS backdoor, Matryoshka v1/v2 RAT, Vminst (lateral movement tool injecting Cobalt Strike via stolen credentials), NetSrv (Cobalt Strike loader), and ZPP (file compressor for exfiltration). Public tools used include Cobalt Strike (trial version), Metasploit, Mimikatz, and Empire. DNS tunneling was the primary C2 channel in both Cobalt Strike and Matryoshka. A shared AI Squared digital certificate found in CopyKittens samples had also been used by OilRig, suggesting possible resource sharing or collaboration between the two groups. A developer username "shiranz" appeared in metadata of multiple samples, providing a consistent attribution artifact.

The Iranian threat agent CopyKittens compromised multiple Israeli websites, including the Jerusalem Post, and one Palestinian Authority website between October 2016 and January 2017. The attackers bought access to the server to gain the access, inserting a single line of Javascript into existing libraries. This enabled them to load further malicious Javascript from a domain they controlled, selectively targeting users based on their IP addresses. The malicious payload used was the BeEF Browser Exploitation Framework.

CopyKitten, a known cyber-attack group, has launched a spearphishing campaign targeting the Israeli government’s Ministry of Communications. The investigation commenced with the identification of a suspicious domain that led to multiple related domains. One such domain closely mimicked the Israeli Prime Minister's SSL VPN login page and was used to drop a malicious Word document titled "Annual Survey.docx." This document had an embedded OLE object that communicated with a C2 server, signifying a well-planned attack. The campaign appears to be part of CopyKitten's ongoing activities against Israeli interests.