Domestic Kitten

Also known as: APT-C-50, Bouncing Golf, Domestic Kitten, DomesticKitten - APT-C-50, G0097

An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive information on the device along with surrounding voice recordings. Researchers with CheckPoint discovered the attack and named it Domestic Kitten. The targets are Kurdish and Turkish natives, and ISIS supporters, all Iranian citizens.

🌍 Country Iran
📅 Activity 2018 — 2018
🧭 ATT&CK G0097
2018
2018

Associated Operations

200 individuals with more than 600 successful infections. It includes 4 currently active campaigns 2019-06 2020-11 2022-10 Domestic Kitten campaign spying on Iranian citizens with new FurBall malware Mobile Campaign ‘Bouncing Golf’ Affects Middle East This operation consists of 10 unique campaigns https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/ https://www.trendmicro.com/en_us/research/19/f/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.html https://www.welivesecurity.com/2022/10/20/domestic-kitten-campaign-spying-iranian-citizens-furball-malware/ the most recent of which began in November 2020. which have targeted over 1

Introduction

An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive information on the device along with surrounding voice recordings. Researchers with CheckPoint discovered the attack and named it Domestic Kitten. The targets are Kurdish and Turkish natives, and ISIS supporters, all Iranian citizens.

Activities and Tactics

Country of Origin: 🇮🇷 Iran

First Seen: 2018

Last Activity: 2018

Notable Campaigns

  • 200 individuals with more than 600 successful infections. It includes 4 currently active campaigns
  • 2019-06
  • 2020-11
  • 2022-10
  • Domestic Kitten campaign spying on Iranian citizens with new FurBall malware
  • Mobile Campaign ‘Bouncing Golf’ Affects Middle East
  • This operation consists of 10 unique campaigns
  • https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/
  • https://www.trendmicro.com/en_us/research/19/f/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.html
  • https://www.welivesecurity.com/2022/10/20/domestic-kitten-campaign-spying-iranian-citizens-furball-malware/
  • the most recent of which began in November 2020.
  • which have targeted over 1

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • MobileOrder
  • Archelaus Beta
  • FurBall:
  • GolfSpy:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] Trend Micro Bouncing Golf 2019 E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.