Who's who in the Zoo - Securelist

ZooPark is a sophisticated Android spyware campaign targeting Middle Eastern users, evolving from basic to advanced spyware through versions v1 to v4 (2015–2017). It uses watering-hole and Telegram-based distribution, exfiltrates contacts, location, messages, call data, app and browser data, photos, and keystrokes, and includes backdoor capabilities for shell access and covert actions.