ZeroT

ATP Sandbox Adv. HeuristicsNetskope IPS

Stats

First seen: April 2022
Last seen: September 2026

MITRE ATT&CK techniques

13 techniques across 5 tactics.

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery

TA0011 Command and Control

T1001Data Obfuscation
- T1001.002Steganography
T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0062TA459

Alert name variants

Alert Name	Engine
Win32.Backdoor.Zerot	ATP Sandbox Adv. Heuristics
Win32.Trojan.Zerot	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Zerot.Generic C2 beacon detected	IPS-SWG

Related blogs

New DOGE Big Balls Ransomware Tools in the Wild

New DOGE Big Balls Ransomware Tools in the Wild

May 7, 20259 min read

Related families

KONNI Bisonal PlugX QakBot InvisiMole