G0097 Bouncing Golf

Bouncing Golf is a cyberespionage campaign targeting Middle Eastern countries.¹

Techniques Used

Domain	ID	Name	Use
mobile	T1476	Deliver Malicious App via Other Means	Bouncing Golf delivered GolfSpy via a hosted application binary advertised on social media.¹
mobile	T1444	Masquerade as Legitimate Application	Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the `com.golf` package.¹

ID	Name	References	Techniques
S0421	GolfSpy	¹	Access Call Log Access Contact List Application Discovery Broadcast Receivers Capture Audio Capture Camera Capture Clipboard Data Capture SMS Messages Data Encrypted Data from Local System Delete Device Data Deliver Malicious App via Other Means Location Tracking Obfuscated Files or Information Process Discovery Screen Capture Standard Application Layer Protocol System Information Discovery