- 180503 zoopark cover 990x400 - Who’s who in the Zoo

ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind the operation infect devices using several generations of , with the including new features in each iteration. We label them from v1-v4, with v4 being the most recent version deployed in 2017. From the technical point of view, the evolution of ZooPark has shown notable progress: from the very basic first and second versions, the commercial spyware fork in its third version and then to the complex spyware that is version 4. This last step is especially interesting, showing a big leap from straightforward code functionality to highly sophisticated .

- 180427 zoopark - Who’s who in the Zoo

Evolution of ZooPark malware features

We have observed two main distribution vectors for ZooPark – Telegram channels and watering holes. The second one was the preferred vector: we found several news websites that have been hacked by the attackers to redirect visitors to a downloading site that serves malicious APKs. Some of the themes observed in campaign include “Kurdistan referendum”, “TelegramGroups” and “Alnaharegypt news”, among others.

- ZooPark infographic - Who’s who in the Zoo

Target profile has evolved during the last years of campaign, focusing on victims in Egypt, Jordan, Morocco, Lebanon and Iran.

If you would like to learn more about our intelligence reports or request more information on a specific report, contact us at: [email protected]

- pdf small5 - Who’s who in the Zoo Read the full “Who’s who in the Zoo. Cyberespionage operation targets Android users in the Middle East.” report



Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here