{"id":56520,"date":"2024-07-09T14:43:16","date_gmt":"2024-07-09T14:43:16","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36081\/Houthi-Rebels-Are-Operating-Their-Own-GuardZoo-Spyware.html"},"modified":"2024-07-09T14:43:16","modified_gmt":"2024-07-09T14:43:16","slug":"houthi-rebels-are-operating-their-own-guardzoo-spyware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/houthi-rebels-are-operating-their-own-guardzoo-spyware\/","title":{"rendered":"Houthi Rebels Are Operating Their Own GuardZoo Spyware"},"content":{"rendered":"

Interview<\/span> When it comes to surveillance malware, sophisticated spyware with complex capabilities tends to hog the limelight \u2013 for example NSO Group’s Pegasus, which is sold to established governments. But it’s actually less polished kit that you’ve never heard of, like GuardZoo \u2013 developed and used by Houthi rebels in Yemen \u2013 that dominates the space.<\/p>\n

This is according to Lookout principal researcher Justin Albrecht, who spoke to us about the analyst’s report<\/a>, out today, revealing the existence of GuardZoo. The report says that the Dendroid RAT<\/a>-based Android surveillanceware, first spotted in 2022, is still active. It has actually been on the scene since at least 2019, Lookout says. The infoseccers believe GuardZoo is linked to Houthi rebels \u2013 based on its targeting of Yemeni military members, as well as logs from GuardZoo’s C2 server, its lures, and other data points. <\/p>\n

GuardZoo is distributed via WhatsApp or direct browser downloads, and appears to rely on social engineering tricks \u2013 for example it impersonates legitimate apps and disseminates military-themed content \u2013 to con users into installing it. Along with seeing it on the devices of victims in Yemen, Lookout says it has also viewed samples of GuardZoo on hardware belonging to military staff in Saudi Arabia, Egypt, and Oman. <\/p>\n