Free scan↗
  • English
  • Deutsch

CopyKittens

threat actorIR
01

also known as

Other names and identifiers for this entity.

ATT&CK

CopyKittens

MISP

CopyKittens · Slayer Kitten

02

resolved ATT&CK groups

Threat groups associated with this.

  • G0052CopyKittens
03

techniques used (8)

ATT&CK techniques this enables or maps to.

  • T1059.001PowerShell
  • T1090Proxy
  • T1218.011Rundll32
  • T1553.002Code Signing
  • T1560.001Archive via Utility
  • T1560.003Archive via Custom Method
  • T1564.003Hidden Window
  • T1588.002Tool
04

software used (4)

Malware and tools associated with this.

  • S0154Cobalt Strike
  • S0363Empire
  • S0167Matryoshka
  • S0164TDTESS
05

references

External citations — patches, advisories, analysis.

  • https://s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf↗
  • https://www.domaintools.com/resources/blog/case-study-hunting-campaign-indicators-on-privacy-protected-attack-infrastr↗
  • http://www.clearskysec.com/copykitten-jpost/↗
  • http://www.clearskysec.com/tulip/↗
  • https://www.cfr.org/interactive/cyber-operations/copykittens↗
  • https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf↗
  • https://attack.mitre.org/groups/G0052/↗
by temnirPrivacySources
Built in Europe© 2026 datadir s.r.o.
v0.1.142checking…