More than 1,200 Iranian citizens have been targeted in extensive cyber-surveillance operations backed by the Iranian government, researchers with cybersecurity firm Check Point report.
The attacks, which Check Point refers to collectively as Domestic Kitten, have been ongoing for roughly four years, orchestrated by a threat actor tracked as APT-C-50, which executes the campaigns on behalf of the Iranian government.
The targets of these attacks, the researchers say, are the Kurdish minority in Iran, opposition forces, internal dissidents, ISIS advocates, and other individuals that the Iranian regime believes could represent a threat.
A total of 10 unique campaigns were observed to date, including 4 that are currently active. The most recent of these campaigns started in November 2020. Two of the remaining three active campaigns have been ongoing since mid-2017, and the last one since mid-2018.
The attacks employed a broad range of vectors to trick victims into installing a malicious Android application: Telegram channels, text messages containing a link to the software, and an Iranian blog. More than 600 of the targeted individuals had their devices infected.
Dubbed FurBall and based on commercially available spyware called KidLogger, the malware leveraged in these attacks is capable of collecting information such as device identifiers, SMS messages, call logs, contact lists, user accounts, browsing history, and a list of installed applications.
Furthermore, it can access a device’s microphone and camera to record sound and video, can record calls, steal files (including from external storage), track the device’s location, and delete messages and files.
Once on the victim’s device, the malware masquerades itself as a fake mobile security application, a news app, a repackaged version of a game, an Android application store, a wallpaper application, or an application for a restaurant in Tehran.
The recent campaigns, Check Point says, leverage the same infrastructure that was used in attacks detailed in 2018.
In addition to victims in Iran, the operations targeted individuals worldwide, including the United States, the United Kingdom, Afghanistan, Pakistan, Turkey, and more.
Related: Cyberespionage Campaign Targets Android Users in Middle East
Related: Twitter Removes Iran-Linked Accounts Aimed at Disrupting U.S. Presidential Debate
Related: Hackers Collecting Intelligence on Potential Opponents to Iranian Regime