Netskope Threat Labs

Zebrocy

ATP Sandbox Adv. HeuristicsNetskope IPS

Description

Zebrocy is a trojan that APT28 has used since at least November 2015, and it comes in several programming language variants, including C++, Delphi, AutoIt, C sharp, VB.NET, and Golang.

Stats

First seen
March 2022
Last seen
October 2026

Also known as

Zekapab

MITRE ATT&CK techniques

31 techniques across 8 tactics.

TA0002 Execution

TA0003 Persistence

  • T1037Boot or Logon Initialization Scripts
  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0006 Credential Access

  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1012Query Registry
  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1120Peripheral Device Discovery
  • T1124System Time Discovery
  • T1135Network Share Discovery
  • T1680Local Storage Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

Associated groups

Alert name variants

Alert Name
Document-Word.Trojan.Zebrocy
Win32.Backdoor.Zebrocy
Win32.Backdoor.Zekapab
Win32.Spyware.Zebrocy
Win32.Trojan.Zebrocy
Win32.Trojan.Zekapab

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Trojan.Zebrocy variant outbound cnc connection
MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection
MALWARE-CNC Win.Trojan.Zebrocy variant payload download attempt
MALWARE-CNC Win.Trojan.Zekapab variant outbound connection

Related families

QakBotPlugXEmpireMacheteInvisiMole

References