CopyKittens encrypts data with a substitute cipher prior to exfiltration.(Citation: CopyKittens Nov 2015)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.(Citation: ClearSky Wilted Tulip July 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

CopyKittens has used PowerShell Empire.(Citation: ClearSky Wilted Tulip July 2017)|