🇮🇷

Domestic Kitten

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

APT-C-50 Bouncing Golf

Target Countries 7

Countries highlighted in red

Afghanistan Iraq Islamic Republic of Iran Pakistan Turkey United States Uzbekistan

Sectors Targeted

No targeted sector recorded

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

Malware Families 1

furball

MITRE ATT&CK 24

T1003 T1036 T1059 T1059.003 T1071.001 T1082 T1083 T1106 T1115 T1125 T1127 T1203 T1218 T1402 T1418 T1426 T1432 T1436 T1437 T1444 T1476 T1533 T1547 T1566

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

Domestic Kitten Check Point

APT-C-50 Check Point

Bouncing Golf Trend Micro

G0097 MITRE

Observed Target Countries 8

Based on ETDA data — countries highlighted in red

Afghanistan Iran Iraq Pakistan Turkey UK USA Uzbekistan

Description

(Check Point) Recent investigations by Check Point researchers reveal an extensive and targeted attack that has been taking place since 2016 and, until now, has remained under the radar due to the artful deception of its attackers towards their targets. Through the use of mobile applications, those behind the attack use fake decoy content to entice their victims to download such applications, which are in fact loaded with spyware, to then collect sensitive information about them. Interestingly, these targets include Kurdish and Turkish natives and ISIS supporters. Most interesting of all, though, is that all these targets are actually Iranians citizens. Considering the nature of the target, the data collected about these groups provides those behind the campaign with highly valuable information that will no doubt be leveraged in further future action against them. Indeed, the malware collects data including contact lists stored on the victim’s mobile device, phone call records, SMS messages, browser history and bookmarks, geo-location of the victim, photos, surrounding voice recordings and more. The targets are Kurdish and Turkish natives and ISIS supporters.

Tools Used 2

FurBall GolfSpy

Operations 3

2019-06 Mobile Campaign ‘Bouncing Golf’ Affects Middle East https://www.trendmicro.com/en_us/research/19/f/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.html

2020-11 This operation consists of 10 unique campaigns, which have targeted over 1,200 individuals with more than 600 successful infections. It includes 4 currently active campaigns, the most recent of which began in November 2020. https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/

2022-10 Domestic Kitten campaign spying on Iranian citizens with new FurBall malware https://www.welivesecurity.com/2022/10/20/domestic-kitten-campaign-spying-iranian-citizens-furball-malware/

Reports & References 1

https://research.checkpoint.com/domestic-kitten-an-iranian-surveillance-operation/

ETDA Profile

Domestic Kitten

Origin

Iran

First Seen 2016

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0097/

View on ETDA APT Groups ↗