Rewterz Threat Alert – APT C-50 aka DomseticKitten – Active IOCs

Severity

High

Analysis Summary

Domestic Kitten also tracked as APT-C-50, is an advanced persistent threat (APT) group. First discovered in 2018, the APT has ties to the Iranian government and has been linked to attacks against domestic citizens. The APT use of mobile applications, those behind the attack uses fake decoy content to entice their victims to download such applications, which are in fact loaded with spyware, to then collect sensitive information about them. Interestingly, these targets include Kurdish and Turkish natives and ISIS supporters. Most interesting of all, though, is that all these targets are actually Iranians citizens. 

Impact

• Information Theft and Espionage

Indicators of Compromise

MD5

• e1bce9e125a80784a8b47e79f32394e4

SHA-256

• eba45508a6a6cfe7ac5a4e5cfedda3e9bfd3d33efaa8bec70470c64734fe92eb

SHA-1

• de777332338e17ca4f97fabaaeb5da5f59570933

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment