Security Experts:

Connect with us

Hi, what are you looking for?



Over 1,200 Iranians Targeted in Domestic Surveillance Campaign

More than 1,200 Iranian citizens have been targeted in extensive cyber-surveillance operations backed by the Iranian government, researchers with cybersecurity firm Check Point report.

More than 1,200 Iranian citizens have been targeted in extensive cyber-surveillance operations backed by the Iranian government, researchers with cybersecurity firm Check Point report.

The attacks, which Check Point refers to collectively as Domestic Kitten, have been ongoing for roughly four years, orchestrated by a threat actor tracked as APT-C-50, which executes the campaigns on behalf of the Iranian government.

The targets of these attacks, the researchers say, are the Kurdish minority in Iran, opposition forces, internal dissidents, ISIS advocates, and other individuals that the Iranian regime believes could represent a threat.

A total of 10 unique campaigns were observed to date, including 4 that are currently active. The most recent of these campaigns started in November 2020. Two of the remaining three active campaigns have been ongoing since mid-2017, and the last one since mid-2018.

The attacks employed a broad range of vectors to trick victims into installing a malicious Android application: Telegram channels, text messages containing a link to the software, and an Iranian blog. More than 600 of the targeted individuals had their devices infected.

Dubbed FurBall and based on commercially available spyware called KidLogger, the malware leveraged in these attacks is capable of collecting information such as device identifiers, SMS messages, call logs, contact lists, user accounts, browsing history, and a list of installed applications.

Furthermore, it can access a device’s microphone and camera to record sound and video, can record calls, steal files (including from external storage), track the device’s location, and delete messages and files.

Once on the victim’s device, the malware masquerades itself as a fake mobile security application, a news app, a repackaged version of a game, an Android application store, a wallpaper application, or an application for a restaurant in Tehran.

The recent campaigns, Check Point says, leverage the same infrastructure that was used in attacks detailed in 2018.

In addition to victims in Iran, the operations targeted individuals worldwide, including the United States, the United Kingdom, Afghanistan, Pakistan, Turkey, and more.

Related: Cyberespionage Campaign Targets Android Users in Middle East

Related: Twitter Removes Iran-Linked Accounts Aimed at Disrupting U.S. Presidential Debate

Related: Hackers Collecting Intelligence on Potential Opponents to Iranian Regime

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


Iranian APT Moses Staff is leaking data stolen from Saudi Arabia government ministries under the recently created Abraham's Ax persona