Domestic Kitten Cluster

Domestic Kitten is an Iranian mobile surveillance cluster active since at least 2016, distinguished by its near-exclusive focus on targeting Iranian citizens and diaspora communities rather than foreign governments or critical infrastructure. The group is assessed to operate on behalf of Iranian state security services and conducts mobile device surveillance operations against individuals deemed threatening to the Iranian regime.

Targets and Goals

Domestic Kitten targets Iranian Kurdish minorities, ISIS supporters (used as cover), Afghan nationals residing in Iran, and Iranian dissidents abroad — particularly those active in opposition groups and the Baluchi ethnic minority community. The group's operations are oriented toward domestic repression: monitoring, tracking, and surveilling Iranian citizens and diaspora members who may pose a threat to the Islamic Republic. This makes Domestic Kitten functionally distinct from Iran's foreign-facing espionage clusters.

Tooling and Tactics

The group primarily operates through fake Android applications — including imitations of popular apps like Telegram and ISIS-related content — that contain embedded spyware. Once installed, these apps harvest SMS messages, call logs, contacts, photos, location data, and voice recordings from infected devices. Check Point Research documented the campaign in 2018, identifying over 1,200 targeted individuals across 10 countries, with most victims located inside Iran. A related cluster, Rampant Kitten, expanded on these capabilities with more sophisticated mobile and desktop surveillance tooling documented by Check Point in 2020.

Aliases

APT-C-50 is the designation used by Chinese cybersecurity researchers (360 Threat Intelligence Center) for the same cluster. Rampant Kitten refers to a related but expanded set of activity documented separately by Check Point in 2020.