Domestic Kitten APT

Domestic Kitten is an Iranian Advanced Persistent Threat (APT) actor that focuses on surveillance operations against political dissidents, and Iranian citizens opposing the political regime in the country heavily. The criminals, also tracked under the aliases APT50 or APT-C-50, operate with a wide range of Windows and Android malware whose capabilities often overlap, but the implants are used in different scenarios due to their more aggressive or passive nature.

The group's activities have been on the radars of malware researchers since 2017, and it is believed that over 1,200 individuals have been targeted by Iranian cybercriminals. Their attack campaigns have a high success rate, and they are usually executed with the use of phishing emails, fake websites, bogus Telegram messages/channels, and malicious text messages. One of Domestic Kitten APT's signature pieces of malware is FurBall – it was employed recently in a large-scale attack against Android users in the region.

The most recent campaign to involve the FurBall Malware used a long list of fake Android applications to promote the dangerous implant. Some of the names of the bogus apps are 'Amaq News Agency Application,' 'Islamic Caliphate,' 'Judgement by what Alla has revealed. 'Omar Farouq' and others.

Users in Iran can protect their devices from the FurBall malware and other Domestic Kitten APT implants by investing in high-quality anti-malware services.