Bouncing Golf G0097

Overview 42 indicators

Bouncing Golf is a cyberespionage campaign targeting Middle Eastern countries.

Techniques 1 ATT&CK

Open in ATT&CK Navigator → or download the layer (1 techniques, layer 4.5)

• T1655.001 Match Legitimate Name or Location

Software 1

• GolfSpy

Principal sources 21 reports

Ranked by how many of this actor's indicators each report brought in.

• 12twitter.com/felixaime/status/1353622368913133569
• 12twitter.com/malwrhunterteam/status/1753545424508440…
• 12virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed…
• 12virustotal.com/gui/ip-address/62.112.8.199/relations
• 12virustotal.com/gui/ip-address/62.112.8.244/relations
• 12virustotal.com/gui/ip-address/62.112.8.60/relations
• 12virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb…
• 12virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218…

Related groups 5

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Patchwork G0040
  1 report cite both
• APT32 G0050
  1 report cite both
• BITTER G1002
  1 report cite both
• CARETO
  1 report cite both
• Lazarus Group G0032
  1 report cite both

Timeline 42 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-01-02 or earlier 3 domainthis year

   x.com/ThreatBookLabs/status/20032619204390913…

   androidsecurityupdate.com

   androidsystemsupdate.com

   googleupdateservicese.com

   copy batch

2. 2024-02-03 3 domain2 yrs ago

   twitter.com/felixaime/status/1353622368913133569 · twitter.com/malwrhunterteam/status/1753545424508440… · virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed… · virustotal.com/gui/ip-address/62.112.8.199/relations · virustotal.com/gui/ip-address/62.112.8.244/relations · virustotal.com/gui/ip-address/62.112.8.60/relations · virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb… · virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218… · virustotal.com/gui/file/5e87acd4f1eca03e68df275b69bd0f… · virustotal.com/gui/file/679355b0f689d745eb6943ed3aa821…

   arzdigitals.com

   ns1.googleassisstants.com

   ns2.googleassisstants.com

   copy batch

3. 2022-10-29 3 url_path4 yrs ago

   x.com/ThreatBookLabs/status/20032619204390913…

   /farahv2.apk

   /negahdarigiahanv2.apk

   /ostadshajarianv5.apk

   copy batch

4. 2022-10-29 3 url_path4 yrs ago

   twitter.com/felixaime/status/1353622368913133569 · twitter.com/malwrhunterteam/status/1753545424508440… · virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed… · virustotal.com/gui/ip-address/62.112.8.199/relations · virustotal.com/gui/ip-address/62.112.8.244/relations · virustotal.com/gui/ip-address/62.112.8.60/relations · virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb… · virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218… · virustotal.com/gui/file/5e87acd4f1eca03e68df275b69bd0f… · virustotal.com/gui/file/679355b0f689d745eb6943ed3aa821…

   /mmh/gt-func.php

   /mmh/lg-upld.php

   /mmh/on-answ.php

   copy batch

5. 2022-10-20 3 url_path4 yrs ago

   twitter.com/felixaime/status/1353622368913133569 · twitter.com/malwrhunterteam/status/1753545424508440… · virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed… · virustotal.com/gui/ip-address/62.112.8.199/relations · virustotal.com/gui/ip-address/62.112.8.244/relations · virustotal.com/gui/ip-address/62.112.8.60/relations · virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb… · virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218… · virustotal.com/gui/file/5e87acd4f1eca03e68df275b69bd0f… · virustotal.com/gui/file/679355b0f689d745eb6943ed3aa821…

   /msd/gt-func.php

   /msd/lg-upld.php

   /msd/on-answ.php

   copy batch

6. 2022-10-20 1 url_path4 yrs ago

   x.com/ThreatBookLabs/status/20032619204390913…

   /sarayemaghale.apk

   copy batch

7. 2022-10-20 1 domain4 yrs ago

   welivesecurity.com/2022/10/20/domestic-kitten-campaign-spy…

   sarayemaghale.hami24.net

   copy batch

8. 2022-01-01 2 domain4 yrs ago

   github.com/ti-research-io/ti/blob/main/ioc_extende…

   googlextabv.com

   newportschoolupdateserver.com

   copy batch

9. 2022-01-01 1 domain4 yrs ago

   virustotal.com/gui/file/a7edd5586ac6cd64eaa1d3fd19077b…

   padre914.com

   copy batch

10. 2021-01-25 3 domain5 yrs ago

    twitter.com/felixaime/status/1353622368913133569 · twitter.com/malwrhunterteam/status/1753545424508440… · virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed… · virustotal.com/gui/ip-address/62.112.8.199/relations · virustotal.com/gui/ip-address/62.112.8.244/relations · virustotal.com/gui/ip-address/62.112.8.60/relations · virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb… · virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218… · virustotal.com/gui/file/5e87acd4f1eca03e68df275b69bd0f… · virustotal.com/gui/file/679355b0f689d745eb6943ed3aa821…

    androidsystemswebview.com

    googleassisstants.com

    googleservicesforar.com

    copy batch

11. 2020-12-19 3 url_path6 yrs ago

    research.checkpoint.com/domestic-kitten-an-iranian-surveillance… · twitter.com/malwrhunterteam/status/1340344596698677… · virustotal.com/gui/file/bd7779e6100e07b3eae67bfcdc53f1…

    /hass/answer.php

    /hass/get-function.php

    /hass/upload-log.php

    copy batch

12. 2020-04-21 3 domain6 yrs ago

    blackberry.com/content/dam/blackberry-com/asset/enterp…

    systemdriverupdate.com

    ydownyload.net

    ynewnow.net

    copy batch

13. 2019-10-09 3 domain, 1 ipv4, 1 url7 yrs ago

    twitter.com/blackorbird/status/1181868468620017665 … · mp.weixin.qq.com/s/yaLC8gs-U92X6WnYzuuQ7w · otx.alienvault.com/pulse/5d9db01cc5328d4649e0594c

    domain	appsoftupdate.com
    domain	lohefeshordeh.net
    domain	ychatonline.net
    ipv4	198.50.220.44:80
    url	http://46.4.143.130

    copy batch

14. 2018-09-10 4 domain, 4 url8 yrs ago

    research.checkpoint.com/domestic-kitten-an-iranian-surveillance… · twitter.com/malwrhunterteam/status/1340344596698677… · virustotal.com/gui/file/bd7779e6100e07b3eae67bfcdc53f1…

    domain	firmwaresystemupdate.com
    domain	georgethompson.space
    domain	ronaldlubbers.site
    domain	stevenwentz.com
    url	http://162.248.247.172
    url	http://190.2.144.140
    url	http://190.2.145.145
    url	http://89.38.98.49

    copy batch

Further reading 23

• attack.mitre.org/groups/G0097
• blog.trendmicro.com/trendlabs-security-intelligence/mobile-…
• otx.alienvault.com/pulse/5d9db01cc5328d4649e0594c
• twitter.com/malwrhunterteam/status/1340344596698677…
• blackberry.com/content/dam/blackberry-com/asset/enterp…
• mp.weixin.qq.com/s/yaLC8gs-U92X6WnYzuuQ7w
• virustotal.com/gui/file/bd7779e6100e07b3eae67bfcdc53f1…
• virustotal.com/gui/ip-address/62.112.8.199/relations
• welivesecurity.com/2022/10/20/domestic-kitten-campaign-spy…
• virustotal.com/gui/ip-address/62.112.8.60/relations
• twitter.com/felixaime/status/1353622368913133569
• virustotal.com/gui/file/3c273166c5221614198a7bbe0ed8ed…
• virustotal.com/gui/file/fcd0be3ff03bd5bfe725c63e274218…
• twitter.com/blackorbird/status/1181868468620017665 …
• virustotal.com/gui/file/5e87acd4f1eca03e68df275b69bd0f…
• twitter.com/malwrhunterteam/status/1753545424508440…
• virustotal.com/gui/file/a7edd5586ac6cd64eaa1d3fd19077b…
• research.checkpoint.com/domestic-kitten-an-iranian-surveillance…
• github.com/ti-research-io/ti/blob/main/ioc_extende…
• virustotal.com/gui/ip-address/62.112.8.244/relations
• x.com/ThreatBookLabs/status/20032619204390913…
• virustotal.com/gui/file/679355b0f689d745eb6943ed3aa821…
• virustotal.com/gui/file/0d09d5e46e779d796a8d295043e5bb…