Loading threat actor…
Zebrocy is a Russia-linked cyberespionage activity cluster associated with Sofacy, also known as APT28 or Fancy Bear. It is commonly tracked as a Sofacy subgroup, while Zebrocy also names its principal malware family. The cluster has been tracked since 2015 and primarily targets government-related organizations, diplomatic entities, and former Soviet republics, particularly in Central Asia. Its wider targeting extends across Europe, the Middle East, and Asia and includes industrial organizations in Kazakhstan. Zebrocy uses spearphishing with malicious Office documents, executable attachments disguised as documents, archives, and layered delivery chains involving shortcuts, PowerShell, encoded payloads, and decoy documents. Its evolving toolset includes implementations in Delphi, AutoIT, Go, C#, Python, and Nim. Initial-stage implants profile compromised systems by collecting system information, installed software, running processes, and screenshots, then transmit that information to command-and-control infrastructure. Follow-on payloads include backdoors, file stealers, keyloggers, and credential harvesters customized for software discovered on victim systems. Observed persistence includes user-level registry autorun mechanisms, while payload encoding, compression, obfuscated command-and-control strings, and downloader self-deletion support concealment. In 2018, Zebrocy deployed Go-based downloaders against Central Asian government and diplomatic targets, followed by AutoIT and Delphi payloads. A March 2021 campaign against Kazakhstan delivered the Delphi-based Delphocy malware through macro-enabled Word documents; the payload intercepted keyboard input and transmitted logged keystrokes. Zebrocy has also deployed the compiled Python tool PythocyDbg within a Southeast Asian foreign affairs organization. Its operational infrastructure and victim targeting have overlapped with Sofacy and GreyEnergy.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Sofacy subgroup conducting campaigns focused on former Soviet republics and Asia, including a Kazakhstan-targeted operation using Delphocy malware delivered via malicious Word documents with VBA macros.
A Sofacy subgroup associated with Delphocy malware campaigns, targeting former Soviet republics and more recently Asia. In this reference, Zebrocy is linked to a March 2021 cluster targeting Kazakhstan using malicious Word documents that drop a Delphi-based keylogger/backdoor.
Group associated with Zebrocy malware, targeting Central Asian government-related organizations via spear-phishing and using Linux-based web server infrastructure.
A Sofacy subset involved in post-exploitation and spear-phishing activity, using shared C2 infrastructure with GreyEnergy and targeting the same industrial company in Kazakhstan around the same time.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.