Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
Threat Actor Profile
Copy Kittens
Copy Kittens, also known as Slayer Kitten, is an Iranian cyberespionage group active since at least 2013. Affiliated with Iranian state interests, the group employs advanced tactics, techniques, and procedures (TTPs) to target governments, IT, and media sectors globally. Their campaigns, such as Operation Wilted Tulip, highlight their focus on information theft and espionage.
Threat Actor Profile
Copy Kittens
Fancy Bear TTPs
Aenean interdum tempor lectus, nec rutrum nisl interdum ut. Aliquam mattis felis vulputate dui ultrices, ac finibus ligula interdum. Proin metus enim, sagittis fringilla viverra quis, pulvinar sit amet quam. Donec eget ullamcorper nibh. Praesent a nisl eu nunc interdum efficitur.
Country of Origin
Copy Kittens is attributed to Iran, with strong evidence linking their operations to Iranian state-sponsored activities.
Members
The exact size and composition of Copy Kittens are unclear. The group operates under aliases such as Slayer Kitten and G0052, indicating a flexible and covert structure.
Leadership
The leadership of Copy Kittens remains unknown. However, their operations suggest a well-organized structure with state-level backing.
Tactics
The group primarily focuses on information theft, espionage, and enabling ransomware attacks. Their targets include government entities, IT infrastructure, and media organizations.
Techniques
Copy Kittens exploits vulnerabilities in public-facing applications, uses phishing campaigns, and deploys custom malware like Matryoshka RAT and Cobalt Strike.
Procedures
The group employs social engineering, webshells, and credential harvesting to infiltrate networks. They also leverage tools like EmpireProject and TDTESS for persistence and lateral movement.
Want to shut down threats before they start?
Indicators of Compromise (IOCs)
Organizations should monitor for:
- Known Fancy Bear malware signatures (e.g., XAgent, ADVSTORESHELL).
- Suspicious domains mimicking government or defense entities.
- Zero-day exploits in applications like Microsoft Windows and Adobe Flash.
- Abnormal network traffic patterns indicating command-and-control communications.
Key Victims
Fancy Bear targets include:
- Governments (United States, Germany, France, Ukraine, and others).
- Military Organizations (focus on NATO-aligned entities).
- Media Outlets and Journalists (especially those covering Kremlin-related topics).
- Critical Infrastructure (energy, aerospace, and defense).
- International Sporting Organizations (e.g., WADA).
- Political Groups (e.g., the Democratic National Committee).
Notable Cyber Attacks
Aenean interdum tempor lectus, nec rutrum nisl interdum ut. Aliquam mattis felis vulputate dui ultrices, ac finibus ligula interdum. Proin metus enim, sagittis fringilla viverra quis, pulvinar sit amet quam. Donec eget ullamcorper nibh. Praesent a nisl eu nunc interdum efficitur.
Operation Wilted Tulip (2013)
A large-scale espionage campaign targeting multiple countries.
Jerusalem Post Breach (2017)
Compromise of Israeli media and government websites.
Notable Cyberattacks
How to Defend Against Copy Kittens
1
Regularly patch vulnerabilities in public-facing applications.
2
Monitor for IOCs like suspicious IPs and domains.
Huntress solutions help protect organizations by monitoring endpoints, detecting intrusions, and mitigating Copy Kitten threats with enterprise-grade technology.
Law Enforcement & Arrests
No arrests have been reported. The group continues to operate with impunity, leveraging state-level resources.
References
Related Threat Actor Profiles
Notable developments include the U.S. indictment of GRU-affiliated officers in 2018. Despite these measures, Fancy Bear remains operational, emphasizing the challenges of deterring state-sponsored cyber actors.
