CopyKittens Cyber Espionage Targets Israeli Diplomats and Researchers

ClearSky and Minerva Labs published the first public report on CopyKittens in November 2015, exposing a series of targeted cyberattacks against Israeli diplomats and academic researchers. The group sent spearphishing emails with carefully tailored subjects — such as UN counter-terrorism registration forms and Ministry of Foreign Affairs questionnaires — that contained Word documents hiding malicious executable files disguised as PDFs. Once opened, a multi-stage malware framework called Matryoshka silently installed itself, establishing remote access to the victim's computer and communicating back to the attackers via DNS traffic. Confirmed targets included a senior Israeli ambassador and researchers specializing in Middle East Studies.

CopyKittens' attribution remains unclear. ClearSky and Minerva Labs characterized them as a mid-level group, noting they assembled most of their attack tools from public code repositories rather than developing capabilities from scratch. The targeting of Israeli diplomats and Middle East Studies researchers aligns with the intelligence priorities of several state actors in the region. No definitive state sponsor was identified in the 2015 report, though subsequent CopyKittens reporting has strengthened the case for Iranian-linked origins based on tool overlaps and infrastructure indicators.

The primary goals were intelligence collection and data theft. The Matryoshka RAT gave the attackers persistent, silent access to victims' computers — capturing keystrokes, taking screenshots, and stealing Outlook email passwords. Targeting senior Israeli diplomats and Middle East Studies researchers would give an adversary insight into diplomatic communications, Israel's foreign policy positions, and academic analysis of regional politics — all high-value intelligence for any state actor with interests in the Middle East.

The campaign was tightly focused on Israel. Confirmed targets included senior diplomats at the Israeli Ministry of Foreign Affairs — including at least one ambassador posted in Eastern Europe — and Israeli academic researchers who specialize in Middle East Studies. The use of MFA-themed lures (questionnaires, diplomatic lists, UN counter-terrorism forms) indicates the attackers had prior knowledge of their targets' roles and routines, suggesting some degree of pre-attack research or earlier access.

Targets received spearphishing emails with Word documents attached. The documents contained hidden executable files — screensavers (.SCR) disguised as PDFs using a Unicode trick that reversed the filename characters so they appeared harmless. Opening the file silently ran the Matryoshka malware: first checking if the system was a security analysis environment, then injecting a remote access tool into a legitimate Windows process, and finally establishing covert communication with the attackers via DNS traffic. A decoy document was shown to the user to avoid suspicion.

Once installed, the Matryoshka RAT gave the attackers persistent, silent access to infected systems. They could record everything the victim typed, take screenshots of the desktop, steal saved email passwords from Outlook, and enumerate running processes. The malware communicated with the attackers using DNS — a protocol that many security tools don't monitor closely — and disguised its traffic using IP addresses from Microsoft and McAfee to make network alerts less likely.

Israeli diplomats and Middle East Studies researchers are high-value intelligence targets because they have direct access to sensitive foreign policy communications, diplomatic cables, and geopolitical analysis. For a state-aligned threat actor with interests in Israeli foreign policy — particularly regarding the broader Middle East — compromising these individuals could reveal negotiating positions, intelligence assessments, and internal government deliberations that would not otherwise be available through open sources.