All actors

ZooPark

Also reported as COBALT JUNO, APT-C-38 (QiAnXin), SABER LION, TG-2884 (SCWX CTU), TG-2884 and 3 other names.

Reports
10
Last reported
Known CVEs
17
ID
zoopark
Merge evidence
8 alias matches

Reports per quarter

  1. 2018 Q2: 5 reports
  2. 2018 Q3: no reports
  3. 2018 Q4: no reports
  4. 2019 Q1: 1 report
  5. 2019 Q2: 2 reports
  6. 2019 Q3: 1 report
  7. 2019 Q4: no reports
  8. 2020 Q1: no reports
  9. 2020 Q2: no reports
  10. 2020 Q3: no reports
  11. 2020 Q4: no reports
  12. 2021 Q1: no reports
  13. 2021 Q2: no reports
  14. 2021 Q3: no reports
  15. 2021 Q4: no reports
  16. 2022 Q1: no reports
  17. 2022 Q2: no reports
  18. 2022 Q3: no reports
  19. 2022 Q4: no reports
  20. 2023 Q1: no reports
  21. 2023 Q2: no reports
  22. 2023 Q3: no reports
  23. 2023 Q4: no reports
  24. 2024 Q1: no reports
  25. 2024 Q2: no reports
  26. 2024 Q3: no reports
  27. 2024 Q4: no reports
  28. 2025 Q1: no reports
  29. 2025 Q2: no reports
  30. 2025 Q3: no reports
  31. 2025 Q4: no reports
  32. 2026 Q1: no reports
  33. 2026 Q2: 1 report
Dated reports, 2018 Q2 to 2026 Q2.

CVEs named in reports

Show all 17 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. APT-C-38_cn

    file creation date fromORKL

  2. APT-C-38_en_google_translate

    file creation date fromORKL

  3. ENISA Threat Landscape Report 2018

    file creation date fromORKL

  4. ZooPark_for_public_final_edited

    file creation date Iain Ellington fromORKL

  5. Who’s who in the Zoo

    date in the title fromORKL

  6. ZooPark_for_public_final_edit

    Malpedia library date Kaspersky fromORKLCCS '25 data

  7. Who's who in the Zoo - Securelist

    date in the CCS '25 data Kaspersky fromORKLCCS '25 data

Newest first. Details opens the report in Explore.