ZooPark_for_public_final_edited.pdf

ZooPark is a multi-year targeted Android cyber-espionage campaign (2015–2017) focused on Middle Eastern victims; the report details four evolving malware versions (v1–v4) capable of stealing contacts, SMS, call logs and audio, GPS, keylogging, screenshots, and app data. Infection vectors include compromised news sites (watering holes) and Telegram channels; the report documents C2 infrastructure (rhubarb2/3, androidupdaters, dlgmail, IPs), sample hashes, signing certificates, and detailed C2/command mechanics, providing a comprehensive set of indicators of compromise and technical TTPs.