CopyKittens__2015__CopyKittens.pdf

**Executive Summary:** This report analyzes a mid-level APT tracked as "CopyKittens" that uses spear-phishing lures to deliver a multi-stage Matryoshka framework (SCR dropper, reflective DLL loader, memory-resident RAT) with anti-analysis techniques and DNS-based command-and-control to exfiltrate data (including Outlook credentials) from Middle East diplomatic and academic targets, and provides IoCs (domains, IPs, hashes) and TTP details for detection and response.