🇮🇷

COBALT JUNO

APT Group 3 zero-day CVEs ETDA ✓

Also Known As 3 names

APT-C-38 (QiAnXin) SABER LION TG-2884 (SCWX CTU)

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

MITRE ATT&CK 4

T1059.001 T1071.001 T1105 T1566.001

Related Zero-Days 3

CVE-2024-50302 CVE-2024-53104 CVE-2024-53197

Known Names 5 entries

ZooPark Kaspersky

TG-2884 SecureWorks

Cobalt Juno SecureWorks

APT-C-38 Qihoo 360

Saber Lion ?

Observed Target Countries 8

Based on ETDA data — countries highlighted in red

Egypt Iraq Iran Jordan Kuwait Lebanon Morocco Kurdistan

Description

(Kaspersky) ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind ZooPark infect Android devices using several generations of malware we label from v1-v4, with v4 being the most recent version deployed in 2017. The preferred infection vector for ZooPark is waterhole attacks. We found several news websites that have been hacked by the attackers to redirect visitors to a downloading site that serves malicious APKs. Some of the themes observed in campaign include “Kurdistan referendum”, “TelegramGroups” and “Alnaharegypt news”, among others. Target profile has evolved during the last years of campaign, focusing on victims in Egypt, Jordan, Morocco, Lebanon and Iran.

Tools Used 1

ZooPark

Reports & References 1

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/05/24122414/ZooPark_for_public_final_edited.pdf

ETDA Profile

ZooPark

Origin

[Unknown]

First Seen 2015

Motivation

Information theft and espionage

View on ETDA APT Groups ↗