{
	"id": "0ff6cc6d-27fd-4485-b2fb-e6cb9cb00f6f",
	"created_at": "2026-04-06T00:08:26.136827Z",
	"updated_at": "2026-04-10T03:34:16.410015Z",
	"deleted_at": null,
	"sha1_hash": "bef4d8750d4a6901105312fe25c9fa0d56aa8e82",
	"title": "Domestic Kitten - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 62242,
	"plain_text": "Domestic Kitten - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 12:42:14 UTC\r\nHome \u003e List all groups \u003e Domestic Kitten\r\n APT group: Domestic Kitten\r\nNames\r\nDomestic Kitten (Check Point)\r\nAPT-C-50 (Check Point)\r\nBouncing Golf (Trend Micro)\r\nG0097 (MITRE)\r\nCountry Iran\r\nSponsor State-sponsored\r\nMotivation Information theft and espionage\r\nFirst seen 2016\r\nDescription\r\n(Check Point) Recent investigations by Check Point researchers reveal an extensive\r\nand targeted attack that has been taking place since 2016 and, until now, has\r\nremained under the radar due to the artful deception of its attackers towards their\r\ntargets. Through the use of mobile applications, those behind the attack use fake\r\ndecoy content to entice their victims to download such applications, which are in\r\nfact loaded with spyware, to then collect sensitive information about them.\r\nInterestingly, these targets include Kurdish and Turkish natives and ISIS supporters.\r\nMost interesting of all, though, is that all these targets are actually Iranians citizens.\r\nConsidering the nature of the target, the data collected about these groups provides\r\nthose behind the campaign with highly valuable information that will no doubt be\r\nleveraged in further future action against them. Indeed, the malware collects data\r\nincluding contact lists stored on the victim’s mobile device, phone call records, SMS\r\nmessages, browser history and bookmarks, geo-location of the victim, photos,\r\nsurrounding voice recordings and more.\r\nThe targets are Kurdish and Turkish natives and ISIS supporters.\r\nObserved Countries: Afghanistan, Iran, Iraq, Pakistan, Turkey, UK, USA, Uzbekistan.\r\nTools used FurBall, GolfSpy.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=624ad02b-d8c3-4873-93a4-28d9811b55d5\r\nPage 1 of 2\n\nOperations performed\nJun 2019\nMobile Campaign ‘Bouncing Golf’ Affects Middle East\nNov 2020\nThis operation consists of 10 unique campaigns, which have targeted\nover 1,200 individuals with more than 600 successful infections. It\nincludes 4 currently active campaigns, the most recent of which began\nin November 2020.\nOct 2022\nDomestic Kitten campaign spying on Iranian citizens with new\nFurBall malware\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=624ad02b-d8c3-4873-93a4-28d9811b55d5\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=624ad02b-d8c3-4873-93a4-28d9811b55d5\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=624ad02b-d8c3-4873-93a4-28d9811b55d5"
	],
	"report_names": [
		"showcard.cgi?u=624ad02b-d8c3-4873-93a4-28d9811b55d5"
	],
	"threat_actors": [
		{
			"id": "44d5df14-6a25-41d6-a54c-7c7ebac358cf",
			"created_at": "2023-01-06T13:46:38.817312Z",
			"updated_at": "2026-04-10T02:00:03.111227Z",
			"deleted_at": null,
			"main_name": "Domestic Kitten",
			"aliases": [
				"Bouncing Golf",
				"APT-C-50"
			],
			"source_name": "MISPGALAXY:Domestic Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c80783db-2b34-4321-ac7e-9a13692ffa31",
			"created_at": "2022-10-25T15:50:23.853579Z",
			"updated_at": "2026-04-10T02:00:05.422314Z",
			"deleted_at": null,
			"main_name": "Bouncing Golf",
			"aliases": [
				"Bouncing Golf"
			],
			"source_name": "MITRE:Bouncing Golf",
			"tools": [
				"GolfSpy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "30f6ddb3-f5aa-4b78-a1a5-e37c42b2c560",
			"created_at": "2022-10-25T16:07:23.544297Z",
			"updated_at": "2026-04-10T02:00:04.64999Z",
			"deleted_at": null,
			"main_name": "Domestic Kitten",
			"aliases": [
				"APT-C-50",
				"Bouncing Golf",
				"G0097"
			],
			"source_name": "ETDA:Domestic Kitten",
			"tools": [
				"FurBall",
				"GolfSpy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434106,
	"ts_updated_at": 1775792056,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/bef4d8750d4a6901105312fe25c9fa0d56aa8e82.pdf",
		"text": "https://archive.orkl.eu/bef4d8750d4a6901105312fe25c9fa0d56aa8e82.txt",
		"img": "https://archive.orkl.eu/bef4d8750d4a6901105312fe25c9fa0d56aa8e82.jpg"
	}
}