Trusted Design

CopyKittens

G0052 · MITRE Pageへのリンク

脅威アクターの詳細

[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)

別名・別称

CopyKittens

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1218.011 - Rundll32
• T1560.003 - Archive via Custom Method
• T1553.002 - Code Signing
• T1090 - Proxy
• T1059.001 - PowerShell
• T1588.002 - Tool
• T1564.003 - Hidden Window

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1560.001)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1560.001)
• CVE-2016-1897 (T1560.001)
• CVE-2015-7261 (T1560.001)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1560.001)
• CVE-2015-0932 (T1560.001)
• CVE-2010-3081 (T1560.001)
• CVE-2017-16929 (T1560.001)
• CVE-2025-31125 (T1560.001)
• CVE-2025-68645 (T1560.001)
• CVE-2014-4114 (T1059.001)
• CVE-2012-1856 (T1218.011)
• CVE-2014-6332 (T1218.011)
• CVE-2012-0158 (T1218.011)
• CVE-2015-1701 (T1218.011)
• CVE-2012-4969 (T1059.001)
• CVE-2014-1776 (T1218.011)
• CVE-2013-3660 (T1218.011)
• CVE-2010-0806 (T1218.011)
• CVE-2015-2360 (T1218.011)
• CVE-2010-4398 (T1218.011)
• CVE-2015-3785 (T1090)
• CVE-2014-0329 (T1090)
• CVE-2016-2342 (T1090)
• CVE-2012-0056 (T1090)
• CVE-2012-4792 (T1090)
• CVE-2013-7331 (T1090)
• CVE-2014-6324 (T1090)
• CVE-2010-0232 (T1090)
• CVE-2026-0723 (T1090)
• CVE-2015-1770 (T1588.002)
• CVE-2017-0199 (T1059.001)
• CVE-2014-6352 (T1588.002)
• CVE-2011-3544 (T1564.003)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る