GolfSpy

MITRE ATT&CK: S0421 View on attack.mitre.org

Aliases: GolfSpy

First seen
2020-01-15 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
android
Profile updated
2026-07-07 13:18:59

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:ma country_code:sa country_code:ae

Context

GolfSpy is Android spyware deployed by the group Bouncing Golf.

Malware & tools used

  • Video Capture (attack-pattern)
  • SMS Messages (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Contact List (attack-pattern)
  • Broadcast Receivers (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Location Tracking (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Data from Local System (attack-pattern)
  • Software Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Process Discovery (attack-pattern)
  • Audio Capture (attack-pattern)
  • Call Log (attack-pattern)
  • Screen Capture (attack-pattern)
  • Archive Collected Data (attack-pattern)
  • File Deletion (attack-pattern)

Used by threat actors

Reports & references

  • Trend Micro — Mobile Cyberespionage Campaign Bouncing Golf Affects Middle East (report)
  • MITRE ATT&CK — S0421 (report)

External references