GuardZoo Malware Targets Over 450 Middle Eastern Military Personnel

Lookout observed an ongoing surveillanceware campaign (GuardZoo) since at least October 2019 that targets military and related personnel in several Middle Eastern countries; the Android malware—derived from leaked Dendroid RAT code—supports 60+ commands for extensive data collection (photos, documents, navigation/mapping files), is distributed via WhatsApp and direct APK downloads, uses ASP.NET C2 servers and dynamic DNS resolving to YemenNet IPs, and has been attributed to a Houthi-aligned actor given targeting, lures, infrastructure, and logs.