Hacker claims he stole data from ZooPark hacking group, some say an Iran-linked APT, which ran a hacking campaign towards Android devices across the Middle East
Earlier this month, Kaspersky published research on the so-called ZooPark group, which ran a hacking campaign towards Android devices across the Middle East. Tweets: @josephfcox , @josephfcox , @lorenzofb , @josephfcox , and @chrisrohlf Tweets: Joseph Cox / @josephfcox : probably the best quote i've ever got from a hacker, talking about a government-linked hacking group after he stole their data https://motherboard.vice.com/ ... pic.twitter.com/rLQau0BeXD Joseph Cox / @josephfcox : New: “Hacking back should be legalized so Kaspersky could of done this themselves.” Kaspersky reported on a government-linked hacking group earlier this month. A source of mine hacked that group's server, and allegedly stole their data. GPS, SMS, more https://motherboard.vice.com/ ... pic.twitter.com/DUKbH51zwx Loenzo Franceschi-Bicchierai / @lorenzofb : A vigilante hacked the servers of “ZooPark,” an APT that's been spying on targets in the Middle East. “I don't think these guys are APTs at all; LamePTs.” [...] “Code reuse kills everyone in the end, if you want to be an APT dont be a fucking skid.” https://motherboard.vice.com/ ... Joseph Cox / @josephfcox : I've been told other people are probing this box belonging to the so-called ZooPark APT. The hacker says he wiped the box so the threat intel companies can stop trying if they want http://motherboard.vice.com/ ... Chris Rohlf / @chrisrohlf : There was a time when you could just look at exploit code and immediately know the handle of who wrote it. I bet this is still true at places that do real attribution. http://motherboard.vice.com/ ...
Context & Ripple Effects
Kaspersky had just published its research unmasking the ZooPark campaign against Middle East Android devices when an anonymous hacker surfaced claiming he had already turned the tables — breaching the group's servers, making off with GPS and SMS data, and wiping them. The claim lands on top of a growing record of offensive groups becoming targets themselves: Check Point later reported that Chinese APT3 rigged machines as traps to reverse-engineer EternalRomance after being attacked with it, and by August Motherboard was profiling Intrusion Truth's months-long effort to expose alleged APT10 members.
First-order effects
- ZooPark, if the claim holds, loses control of its own infrastructure and has its victims' GPS and SMS data in someone else's hands — a direct operational and reputational blow to an allegedly government-linked unit.
- Kaspersky's attribution work gets an unusual form of corroboration: stolen material from inside the group can confirm what its researchers inferred from samples alone.
Second-order effects
- Other APT operators must now weigh their own tooling and servers as attack surface, since the same mobile spyware that harvests victims' GPS and SMS data leaves traces rivals and vigilantes can follow back.
- Security vendors gain a new evidence channel — data taken from intruders rather than endpoints — which sharpens attribution contests between vendors tracking Iranian, Chinese, and Russian-linked crews.
Third-order effects
- If counter-hacking against state-linked groups keeps recurring, the line between attacker and target blurs structurally, pushing governments toward formal positions on hacking back while independent actors effectively practice it already.
- Attribution shifts from inference to possession: whoever holds an APT's own stolen data can name it with far more confidence, raising the cost of deniable state operations.
The trend: State-sponsored hacking groups are increasingly becoming targets themselves, as independent hackers and researchers counter-intrude, steal their data, and strip away their anonymity.