Zebrocy

MITRE ATT&CK: S0251 View on attack.mitre.org

Aliases: Zekapab, Zebrocy

First seen: 2015-11-01 00:00:00
Malware type: trojan, downloader
Family: Malware family
Operating systems: windows
Related IoCs: 6 (4 malicious)
Last IoC activity: 2026-10-18 01:56:50
Profile updated: 2026-07-07 12:43:03

Targeted industries: government-and-public-sector defense-and-aerospace technology-and-telecommunications

Targeted regions: country_code:ru country_code:us country_code:de country_code:ua

Context

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang.

Recent IoC activity

4 malicious indicators in Maltiverse are attributed to Zebrocy (S0251). The 4 most recently updated:

Type	Indicator	Updated	Sources
file sample	9d5203b156088474c30f3a699235f0f29c5b7baead24e2cdb8c38da150c7ee18	2026-10-14	1
hostname	couldinstallup.com	2026-10-13	2
URL	https://couldinstallup.com	2026-10-13	2
URL	https://github.com/mandiant/capa-testfiles/blob/master/Practical%20Malware%20...	2026-09-04	1

Detection coverage

2 YARA rules
422 Sigma rules

Malware & tools used

System Time Discovery (attack-pattern)
Process Discovery (attack-pattern)
Windows Management Instrumentation (attack-pattern)
System Network Connections Discovery (attack-pattern)
Ingress Tool Transfer (attack-pattern)
Screen Capture (attack-pattern)
Peripheral Device Discovery (attack-pattern)
System Owner/User Discovery (attack-pattern)
Credential API Hooking (attack-pattern)
Exfiltration Over C2 Channel (attack-pattern)
System Information Discovery (attack-pattern)
Mail Protocols (attack-pattern)
Web Protocols (attack-pattern)
System Network Configuration Discovery (attack-pattern)
File and Directory Discovery (attack-pattern)
Registry Run Keys / Startup Folder (attack-pattern)
Software Packing (attack-pattern)
Local Storage Discovery (attack-pattern)
Archive Collected Data (attack-pattern)
Logon Script (Windows) (attack-pattern)
Windows Command Shell (attack-pattern)
Asymmetric Cryptography (attack-pattern)
Local Data Staging (attack-pattern)
Query Registry (attack-pattern)
File Deletion (attack-pattern)

Used by threat actors

APT28 (threat-actor)

Detection rules

MALPEDIA_Win_Zebrocy_Auto (yara-rule)
DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy (yara-rule)

Reports & references

Kaspersky — 83930 (report)
Palo Alto Unit 42 — Dear Joohn Sofacy Groups Global Campaign (report)
accenture.com — Blogs Snakemackerel Delivers Zekapab Malware (report)
Broadcom/Symantec — Apt28 Espionage Military Government (report)
accenture.com — Accenture Snakemackerel Delivers Zekapab Malware (report)
bleepingcomputer.com — Russian Hackers Use Fake Nato Training Docs To Breach Govt Networks (report)
quointelligence.eu — Apt28 Zebrocy Malware Campaign Nato Theme (report)
Palo Alto Unit 42 — Fighting Ursa (report)
Kaspersky — 91897 (report)
researchcenter.paloaltonetworks.com — Unit42 Sofacy Groups Parallel Attacks (report)
ESET — Journey Zebrocy Land (report)
intezer.com — Intezer 2020 Go Malware Round Up (report)
ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
Kaspersky — 89506 (report)
Palo Alto Unit 42 — Sandbox Evasion Memory Detection (report)
malpedia.caad.fkie.fraunhofer.de — Win.Zebrocy (report)
Kaspersky — 89419 (report)
vkremez.com — Lets Learn Dissecting Apt28Sofacy (report)
mp.weixin.qq.com — 6R7Bfs9Lh1I3Bndkatcc9G (report)
mp.weixin.qq.com — Pe 6Vrdk 2Ati996Sff0Og (report)
Kaspersky — 90680 (report)
Palo Alto Unit 42 — Sofacy Creates New Go Variant Of Zebrocy Tool (report)
brandefense.io — Zebrocy Malware Technical Analysis Report (report)
ESET — Sednit Whats Going Zebrocy (report)
ESET — Sednit Update Analysis Zebrocy (report)