Domestic Kitten is a mobile surveillance operation targeting Iranian citizens with malicious apps.
Domestic Kitten (also tracked as Bouncing Golf, APT-C-50) is an extensive surveillance operation targeting Iranian citizens, specifically Kurdish and Turkish natives, as well as ISIS supporters. The actor uses malicious mobile apps designed to collect sensitive device information and surrounding voice recordings. Defenders should focus on monitoring for suspicious or unofficial Android applications targeting these specific groups, enforce strict mobile security policies, and watch for indicators of abnormal data exfiltration patterns.
An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive information on the device along with surrounding voice recordings. Researchers with CheckPoint discovered the attack and named it Domestic Kitten. The targets are Kurdish and Turkish natives, and ISIS supporters, all Iranian citizens.
Domestic Kitten uses malicious mobile apps to collect sensitive device information and surrounding voice recordings.
The Domestic Kitten operation targets Kurdish and Turkish natives, and ISIS supporters, all Iranian citizens.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.