ZooPark is an Iranian state-backed cyber-espionage group that emerged in June 2015, primarily targeting Android mobile devices across the Middle East. Its core motivation is politically driven intelligence gathering, aiming to surveil individuals and organizations. The group is characterized by the continuous evolution of its custom Android spyware, progressing through four distinct versions from a basic data-stealer to a highly sophisticated surveillance tool, potentially integrating commercially available spyware components in its later stages. ZooPark gained initial access through compromised news websites and malicious links shared on Telegram, often using politically charged lures to entice victims. The group's sustained focus on mobile platforms and its iterative development of sophisticated spyware for specific Middle Eastern targets set it apart from other threat actors, which are sometimes broadly labeled 'APT-C-23' or 'Domestic Kitten' but are distinct operations.

Aliases del actor

APT-C-38Saber Lionotros relacionados con países como EgiptoJordonMarruecosLíbanoIránel Kurdistan iraquívinculación con países como EgiptoJordaniadominios relacionados con análisis de amenazas

Actores similares

apt-desertfalconactor · 1apt-stealthfalconactor · 1apt-glassesactor · 1Desert Falconsapt · 0Conquerors Electronic Armyapt · 0Operation DRBControlapt · 0Confuciousapt · 0PhantomControlapt · 0apt-silencerlionactor · 1contiransomware · 351