Description
NativeZone is the name given collectively to disposable custom loaders for Cobalt Strike that cyberattackers associated with APT29 have used since at least 2021. The loaders deliver the Cobalt Strike beacon, which handles command execution and lateral movement on compromised networks. Because each loader is disposable, defenders get more value from watching for beacon behavior than from hunting for individual loader samples.
Stats
- First seen
- March 2022
- Last seen
- October 2026
MITRE ATT&CK techniques
6 techniques across 2 tactics.
Associated groups
Alert name variants
| Alert Name |
|---|
| Gen:Variant.NativeZone.1 |
| Gen:Variant.NativeZone.2 |
| Gen:Variant.NativeZone.3 |
| Gen:Variant.NativeZone.5 |
| Gen:Variant.NativeZone.8 |
| Gen:Variant.NativeZone.9 |
| Shortcut.Trojan.NativeZone |
| Win32.Trojan.NativeZone |
| Win64.Trojan.NativeZone |