Home > List all groups > Domestic Kitten

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Domestic Kitten

NamesDomestic Kitten (Check Point)
APT-C-50 (Check Point)
CountryIran Iran
MotivationInformation theft and espionage
First seen2016
Description(Check Point) Recent investigations by Check Point researchers reveal an extensive and targeted attack that has been taking place since 2016 and, until now, has remained under the radar due to the artful deception of its attackers towards their targets. Through the use of mobile applications, those behind the attack use fake decoy content to entice their victims to download such applications, which are in fact loaded with spyware, to then collect sensitive information about them. Interestingly, these targets include Kurdish and Turkish natives and ISIS supporters. Most interesting of all, though, is that all these targets are actually Iranians citizens.

Considering the nature of the target, the data collected about these groups provides those behind the campaign with highly valuable information that will no doubt be leveraged in further future action against them. Indeed, the malware collects data including contact lists stored on the victim’s mobile device, phone call records, SMS messages, browser history and bookmarks, geo-location of the victim, photos, surrounding voice recordings and more.

The targets are Kurdish and Turkish natives and ISIS supporters.
ObservedCountries: Afghanistan, Iran, Iraq, Pakistan, Turkey, UK, USA, Uzbekistan.
Tools usedFurBall.
Operations performedNov 2020This operation consists of 10 unique campaigns, which have targeted over 1,200 individuals with more than 600 successful infections. It includes 4 currently active campaigns, the most recent of which began in November 2020.

Last change to this card: 18 April 2021

Download this actor card in PDF or JSON format

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key