CopyKittens__2015__Minerva_Clearsky_CopyKittens_11-23-15.pdf

Minerva Labs and ClearSky analyze the CopyKittens campaign: a mid-level threat actor using targeted spear-phishing lures to deliver a multi-stage 'Matryoshka' infection (SCR dropper → reflective DLL loader → in-memory RAT). The toolset uses anti-analysis checks (Pafish-derived), reflective DLL injection, runtime API resolution and DNS-based command-and-control/exfiltration to steal Outlook credentials, keylog and capture screens; the report includes persistence methods, evolving TTPs and a comprehensive list of IoCs (domains, IPs, hashes).