What tactics and techniques does CopyKittens use?

How CopyKittens Operates Across the Intrusion Chain

CopyKittens’ playbook is built around getting a foothold quickly, then turning that foothold into durable access and intelligence collection. The group’s tactics fit a classic espionage model: initial access through social engineering or stolen access, followed by malware-assisted execution, then internal discovery and data theft once inside the environment.

That sequence matters because it shows the activity is not limited to one intrusion method. It combines MITRE ATT&CK Enterprise Matrix style adversary behavior with overlapping stages that defenders need to detect as a chain, not as isolated events.

For teams mapping the campaign to threat actor context, the Threat Actor Groups Guide is useful for understanding how group naming, aliases, and campaign attribution are used when tracking crews like CopyKittens.

What the Group’s Core Techniques Tell Defenders to Watch For

The direct techniques called out in reporting are spearphishing, credential theft, malware deployment, persistence, internal reconnaissance, and collection of sensitive data. Practically, that means defenders should expect email-delivered intrusion attempts, account abuse that does not look like normal user behaviour, and endpoint activity that suggests an attacker is trying to stay resident rather than merely break in once.

These techniques are especially concerning because they blend human targeting with technical follow-through. A successful spearphish can deliver the initial payload, but credential theft and persistence are what let the group widen access, move quietly, and return after defenders think the incident is over. That is why the campaign should be assessed for both access abuse and post-compromise discovery activity.

The phishing element also overlaps with well-known lure patterns, so a broad phishing control baseline is relevant. The Top 10 Phishing Techniques page helps security teams compare common lure mechanics with the sort of email-based intrusion path CopyKittens uses.

Why Persistence and Reconnaissance Change the Incident Response Priority

Once a group has credential access and a durable foothold, the incident shifts from a single malware event to an access and trust problem. Internal reconnaissance usually means the attacker is identifying high-value systems, privileged accounts, shared drives, mailboxes, or other places where sensitive data can be reached without triggering immediate alarms.

That changes response priorities. It is not enough to remove a single malicious file or block one sender. Investigators need to determine whether the attacker harvested credentials, created alternate access paths, or used the original compromise to reach additional systems. Long-lived access is often the telltale sign that the initial intrusion has become a broader compromise.

Defenders should therefore correlate email security logs, identity and access logs, endpoint detections, and unusual data access patterns rather than treating each alert as separate noise.

Risk and Threat Considerations

CopyKittens’ technique mix is high risk because it combines social engineering with post-compromise persistence. Once an attacker has working credentials or a stable foothold, the organisation can lose visibility into which actions are legitimate and which are adversarial, especially if the attacker uses normal tools and normal accounts.

Failure mechanism: Spearphishing or credential theft gives the group a trusted entry path, then malware and internal discovery let it expand access while blending into ordinary user and endpoint activity.

Impact: The result can be prolonged espionage, repeated access, and the silent collection of sensitive data before defenders recognise that the intrusion has moved beyond the initial email or endpoint event.

Practitioner Guidance

What to verify: Check whether the initial compromise was limited to a single mailbox or endpoint, or whether the attacker obtained additional credentials, tokens, or reusable access paths. If you see lateral discovery, treat the incident as a multi-system compromise, not a one-host cleanup.

Decision rule: If the intrusion involved authenticated access, prioritise account review, session invalidation, and mailbox or endpoint containment before relying on malware removal alone. If persistence is confirmed, assume the attacker may have already searched for sensitive data.

What good looks like: Email, identity, endpoint, and data-access telemetry should let you reconstruct the full path from lure to access to collection. The key question is whether you can prove the attacker was evicted everywhere they could authenticate, not just where they were first detected.

Practitioner takeaway: With CopyKittens-style activity, the real danger is the transition from initial access to durable, quietly exploited access, so response quality depends on proving scope, closing reuse paths, and checking for data collection.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?