GENERAL__2017__Clearsky_Operation_Wilted_Tulip_07-25-2017.pdf

This threat intelligence report analyzes CopyKittens (Operation Wilted Tulip), detailing the group’s long-running cyber espionage activities, including multiple self-developed malware families, extensive web-based and watering hole attack campaigns, and a wealth of infrastructure and indicators (domains, IPs, and C2 patterns) used to compromise government and large IT organizations across Israel, the US, Turkey, and Germany, highlighting a highly capable and persistent threat actor with broad reach and sophisticated tooling.