Zebrocy

MITRE ATT&CK: S0251 View on attack.mitre.org

Aliases: Zekapab, Zebrocy

First seen: 2015-11-01 00:00:00
Malware type: trojan, downloader
Family: Malware family
Operating systems: windows
Related IoCs: 4 (2 malicious)
Last IoC activity: 2026-09-01 23:56:54
Profile updated: 2026-07-07 12:43:03

Targeted industries: government-and-public-sector defense-and-aerospace technology-and-telecommunications

Targeted regions: country_code:ru country_code:us country_code:de country_code:ua

Context

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang.

Recent IoC activity

3 malicious indicators in Maltiverse are attributed to Zebrocy (S0251). The 3 most recently updated:

Type	Indicator	Updated	Sources
hostname	couldinstallup.com	2026-09-02	2
URL	https://couldinstallup.com	2026-09-02	2
URL	https://github.com/mandiant/capa-testfiles/blob/master/Practical%20Malware%20...	2026-04-27	1

Detection coverage

2 YARA rules
422 Sigma rules

Malware & tools used

System Time Discovery (attack-pattern)
Process Discovery (attack-pattern)
Windows Management Instrumentation (attack-pattern)
System Network Connections Discovery (attack-pattern)
Ingress Tool Transfer (attack-pattern)
Screen Capture (attack-pattern)
Peripheral Device Discovery (attack-pattern)
System Owner/User Discovery (attack-pattern)
Credential API Hooking (attack-pattern)
Exfiltration Over C2 Channel (attack-pattern)
System Information Discovery (attack-pattern)
Mail Protocols (attack-pattern)
Web Protocols (attack-pattern)
System Network Configuration Discovery (attack-pattern)
File and Directory Discovery (attack-pattern)
Registry Run Keys / Startup Folder (attack-pattern)
Software Packing (attack-pattern)
Local Storage Discovery (attack-pattern)
Archive Collected Data (attack-pattern)
Logon Script (Windows) (attack-pattern)
Windows Command Shell (attack-pattern)
Asymmetric Cryptography (attack-pattern)
Local Data Staging (attack-pattern)
Query Registry (attack-pattern)
File Deletion (attack-pattern)

Used by threat actors

APT28 (threat-actor)

Detection rules

DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy (yara-rule)
MALPEDIA_Win_Zebrocy_Auto (yara-rule)

Reports & references

Kaspersky — 83930 (report)
Palo Alto Unit 42 — Dear Joohn Sofacy Groups Global Campaign (report)
accenture.com — Blogs Snakemackerel Delivers Zekapab Malware (report)
Broadcom/Symantec — Apt28 Espionage Military Government (report)
accenture.com — Accenture Snakemackerel Delivers Zekapab Malware (report)
bleepingcomputer.com — Russian Hackers Use Fake Nato Training Docs To Breach Govt Networks (report)
quointelligence.eu — Apt28 Zebrocy Malware Campaign Nato Theme (report)
Palo Alto Unit 42 — Fighting Ursa (report)
Kaspersky — 91897 (report)
researchcenter.paloaltonetworks.com — Unit42 Sofacy Groups Parallel Attacks (report)
ESET — Journey Zebrocy Land (report)
intezer.com — Intezer 2020 Go Malware Round Up (report)
ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
blackberry.com — Report Old Dogs New Tricks (report)
secureworks.com — Iron Twilight (report)
research.checkpoint.com — Malware Against The C Monoculture (report)
github.com — Microsoft 365 Defender Hunting Queries (report)
ics-cert.kaspersky.com — Kaspersky Ics Cert Apt Attacks On Industrial Organizations In H1 2021 En (report)
macnica.net — Mpressioncss Ta Report 2019 (report)
cocomelonc.github.io — Malware Pers 20 (report)
researchcenter.paloaltonetworks.com — Unit42 Sofacy Continues Global Attacks Wheels New Cannon Trojan (report)
Kaspersky — 89506 (report)
Palo Alto Unit 42 — Sandbox Evasion Memory Detection (report)
malpedia.caad.fkie.fraunhofer.de — Win.Zebrocy (report)
Kaspersky — 89419 (report)