Loading malware…
Zebrocy, also known as Zekapab, is a Windows backdoor associated with the Russian state-sponsored cyberespionage group APT28, also known as Fancy Bear. The family includes a Go-based variant and supports information collection, secondary-payload deployment, persistence, and data exfiltration.
Zebrocy gathers usernames, running-process information, local network configuration, system date and time-zone information, and newly added network drives. Some variants capture screenshots in JPEG and BMP formats. It can deploy credential-dumping tools that extract browser credentials and store them in database files. Persistence mechanisms include scheduled tasks and registry-based autostart entries. Zebrocy can decode secondary payloads and write them to disk, uses AES and XOR to decrypt strings and payloads, and has a command to delete files and directories. It has exfiltrated data through HTTP POST requests using URL/percent encoding.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The APT28 software table lists Zebrocy with automated collection, credential access, screenshots, payload transfer, persistence, and exfiltration.
PETROVITE demonstrates Stage 1 of the ICS Kill Chain capabilities and targets mining and energy operations in Kazakhstan.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A long-running, multi-language APT28/Sofacy malware family used in espionage campaigns, with loader and backdoor variants.
A long-running malware family mentioned because some GigaWiper samples showed classifier overlap and technical similarities with it; the article does not establish definitive attribution or direct operational use in this event.
A multilingual first-stage downloader and backdoor family used against embassies and ministries of foreign affairs, often treated as an APT28-associated operational cluster.
Referenced as a malware family associated with APT28 whose AutoIt variants search for predefined file extensions and use similar phishing and collection tradecraft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.