{
  "id": "copykittens",
  "name": "CopyKittens",
  "aliases": [],
  "domain": "cyber",
  "country": "IRN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Iranian group",
      "src": [
        "mitre-g0052"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2013,
      "src": [
        "mitre-g0052"
      ],
      "conf": "medium",
      "note": "At least 2013"
    },
    {
      "k": "attack_id",
      "v": "G0052",
      "src": [
        "mitre-g0052"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany.",
      "src": [
        "mitre-g0052"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 8,
      "src": [
        "mitre-g0052"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Cobalt Strike, Empire, Matryoshka, TDTESS",
      "src": [
        "mitre-g0052"
      ],
      "conf": "high",
      "note": "4 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0052)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/copykittens.html",
  "sources": {
    "mitre-g0052": {
      "title": "CopyKittens, Group G0052",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0052/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}