Hacker says he stole data from ZooPark hacking group, some say an Iran-linked APT, which ran a hacking campaign targeting Android devices across the Middle East
Joseph Cox / Motherboard : Tweets: @chrisrohlf , @josephfcox , @josephfcox , @lorenzofb , and @josephfcox Tweets: Chris Rohlf / @chrisrohlf : There was a time when you could just look at exploit code and immediately know the handle of who wrote it. I bet this is still true at places that do real attribution. http://motherboard.vice.com/ ... Joseph Cox / @josephfcox : probably the best quote i've ever got from a hacker, talking about a government-linked hacking group after he stole their data https://motherboard.vice.com/ ... pic.twitter.com/rLQau0BeXD Joseph Cox / @josephfcox : New: “Hacking back should be legalized so Kaspersky could of done this themselves.” Kaspersky reported on a government-linked hacking group earlier this month. A source of mine hacked that group's server, and allegedly stole their data. GPS, SMS, more https://motherboard.vice.com/ ... pic.twitter.com/DUKbH51zwx Loenzo Franceschi-Bicchierai / @lorenzofb : A vigilante hacked the servers of “ZooPark,” an APT that's been spying on targets in the Middle East. “I don't think these guys are APTs at all; LamePTs.” [...] “Code reuse kills everyone in the end, if you want to be an APT dont be a fucking skid.” https://motherboard.vice.com/ ... Joseph Cox / @josephfcox : I've been told other people are probing this box belonging to the so-called ZooPark APT. The hacker says he wiped the box so the threat intel companies can stop trying if they want http://motherboard.vice.com/ ...
Context & Ripple Effects
Kaspersky had already put ZooPark on the map with a report identifying it as a government-linked group behind an Android espionage campaign across the Middle East, which some researchers attribute to an Iran-linked APT. Now the hunters have been hunted: an unknown hacker says he breached the group's own infrastructure, per the initial claim of the ZooPark data theft.
The twist that makes this more than a defacement story is what the hacker did next — he says he wiped the ZooPark server specifically to prevent further analysis by threat intelligence firms, destroying evidence that firms like Kaspersky would otherwise mine for attribution.
First-order effects
- Threat intelligence firms lose their best source material: by wiping the server rather than preserving it, the intruder denies Kaspersky and other researchers fresh malware samples and operational data to extend their ZooPark reporting.
Second-order effects
- State-linked groups now have to defend their own command-and-control infrastructure against exactly the intrusion techniques they deploy on victims, raising their operating costs.
- The episode feeds a growing pattern of outsiders exposing state hackers — the same year, the anonymous Intrusion Truth campaign began publishing information on alleged members of China's APT10, showing unmasking has become a weapon available to non-state actors.
Third-order effects
- If stolen-hacking-group data keeps surfacing — echoing how NSA cyber capabilities were stolen from a contractor's laptop — offensive operations start carrying blowback risk that reshapes how states secure their own tooling, and the line between researcher, vigilante, and adversary keeps blurring.
The trend: State-sponsored hacking groups are increasingly becoming targets themselves, as independent hackers and researchers turn breach-and-expose tactics against the very actors running covert campaigns.