APT-C-50
APT-C-50 is a threat actor group, tracked by Brandefense. It targets organisations in 8 countries, including the United States and the United Kingdom. It uses 2 MITRE ATT&CK techniques.
- Techniques
- 2
- Exploited CVEs
- No CVE data
- First seen
- Oct 23, 2022
- Last seen
- Oct 23, 2022
- Record updated
Who They Target.
About APT-C-50.
APT-C-50, also known as Domestic Kitten and Bouncing Golf, is an advanced, Iran-linked threat actor associated with the Iranian government. Active since at least 2016, the group specializes in extensive and long-running mobile surveillance operations. Its primary objective is to monitor individuals and groups considered to be a threat to the stability of the Iranian regime. The group's targeting is focused primarily on Iranian citizens, including internal dissidents, opposition forces, ISIS advocates, and the Kurdish minority. However, its operations have a global reach, with victims also identified in the United States, Great Britain, Pakistan, Afghanistan, and Turkey. Over the course of its operations, APT-C-50 has targeted over 1,200 individuals, resulting in more than 600 successful device infections. APT-C-50's main tool is a custom Android malware called FurBall, which has been in use since the beginning of its operations. FurBall is based on code from the commercial monitoring software KidLogger and possesses a wide range of surveillance capabilities.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.