CopyKittens: Espionage Campaign Targeting Strategic Sectors Across the Globe

Operation Wilted Tulip is the name given to CopyKittens' full espionage apparatus, documented in a joint July 2017 report by ClearSky and Trend Micro. CopyKittens, active since at least 2013, ran a broad campaign targeting government ministries, defense contractors, academic institutions, IT companies, and media organizations across Israel, Saudi Arabia, Turkey, the US, Jordan, and Germany. They used five attack methods simultaneously: watering hole attacks on breached news websites, spearphishing emails with malicious documents, browser exploitation via compromised email accounts, fake Facebook personas, and SQL injection against web servers. The campaign involved both custom malware and publicly available hacking tools.

CopyKittens is assessed to be an Iranian-linked threat actor. Several indicators point to Iranian origin: the "Emet press" fake news site was built using NovinWebGostar, an Iranian web development platform; Havij, a SQL injection tool distributed by the Iranian security company ITSecTeam, was part of their toolkit; and a digital certificate found in their malware samples had also been used by OilRig, another Iran-linked group. The campaign's primary targeting of Israel, Saudi Arabia, and Turkey aligns with Iranian geopolitical interests. No definitive state sponsor attribution has been publicly confirmed, but the cumulative evidence strongly points to an Iranian nexus.

The primary goal was intelligence collection and data exfiltration. Once inside a target network, CopyKittens moved laterally and indiscriminately exfiltrated large volumes of documents, spreadsheets, personal data files, configuration files, and databases. The group showed a pattern of getting "greedy" — infecting multiple computers within an organization at once, which often triggered defensive alerts and led to their discovery. The scale of infrastructure and the length of the campaign — spanning at least four years — confirms this was a sustained, systematic intelligence collection operation aligned with Iranian state interests.

The campaign was broad. Confirmed targeted countries include Israel, Saudi Arabia, Turkey, the United States, Jordan, and Germany, with occasional targeting of individuals in other countries and UN employees. ClearSky and Trend Micro estimated that at least a few hundred people had been infected across multiple organizations. Named victims include Jerusalem Post, Maariv, and the IDF Disabled Veterans Organization — all breached and used as watering hole platforms. Ministries of Foreign Affairs in 28+ countries received the CVE-2017-0199 spearphishing email sent from the compromised Northern Cyprus MFA account.

Primary targets were government institutions (particularly Ministries of Foreign Affairs), defense companies, academic institutions, large IT companies, and media outlets. The focus on foreign ministries and defense contractors is consistent with state-directed intelligence collection. IT companies were also attractive because breaching one could provide VPN access to their client organizations — in at least one documented case, CopyKittens did exactly that, using a breached IT company's VPN credentials to pivot into client networks.

CopyKittens used five methods simultaneously. First, they injected BeEF (Browser Exploitation Framework) JavaScript into breached news websites — serving malicious code only to specific target IP addresses visiting those sites. Second, they compromised email accounts at target organizations and replied to existing email threads with links to attacker-built sites that fingerprinted visitors' browsers before delivering exploits. Third, they sent spearphishing emails with malicious documents — some exploiting CVE-2017-0199 (a Word vulnerability allowing silent code execution), others using RTLO characters to make executable files appear to be PDFs, and others with VBA macros. Fourth, they built and maintained fake Facebook personas with thousands of followers over years, and a fake Israeli news aggregator ("Emet press"), to build trust with targets. Fifth, they used Havij, sqlmap, and Acunetix to scan and exploit vulnerabilities in internet-facing web servers at target organizations.

Israel, Saudi Arabia, Turkey, and Germany are all countries with geopolitical tensions with Iran, making their government communications, defense capabilities, and foreign policy decisions high-priority intelligence targets. Academic and research institutions produce knowledge relevant to Iran's security and technology interests. IT companies are attractive because compromising them can provide access to many downstream client organizations at once. Media outlets were primarily used as watering hole platforms rather than targeted for their own data — their high traffic from relevant communities made them useful delivery vehicles. The multi-year, multi-vector approach reflects a well-resourced, state-directed operation with sustained intelligence collection mandates across the region.