New ZooPark APT targets Android users in Middle East since 2015

Security researchers from Kaspersky Lab have uncovered a new cyber-espionage APT group tracked ZooPark that targeted entities in the Middle East during the past three years.

ZooPark APT has been active at least since 2015 and has shown a growing level of sophistication across the years.

“ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind ZooPark infect Android devices using several generations of malware we label from v1-v4, with v4 being the most recent version deployed in 2017.” reads the report published by Kaspersky

Hackers mainly used waterhole attacks as infection vector, the experts discovered several news websites that have been compromised to redirect visitors to a downloading site that delivered the final malware.

Most of the victims were located in  Egypt, Jordan, Morocco, Lebanon, and Iran.
 
Link to Full article