Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Following initial exploitation of CVE-2021-40539 on a targeted system, DEV-0322 performed several activities including credential dumping, installing custom binaries, and dropping malware to maintain persistence and move laterally within the network.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“DEV-0322 also deployed a Trojan that we are calling Trojan:Win64/Zebracon.”
2 distinct techniques documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trojan deployed by DEV-0322 that uses hardcoded credentials to connect to suspected compromised Zimbra email servers. It obtains an authorization token and uses SOAP email operations to search, read, and send messages, receiving attacker commands through a controlled mailbox. It was deployed following initial exploitation of ManageEngine ADSelfService Plus; the content does not establish that Zebracon itself exploits the vulnerability.
A trojan/backdoor used by DEV-0322 that connects to compromised Zimbra email servers using hardcoded credentials, obtains a ZM_AUTH_TOKEN, and performs SOAP-based email operations such as searching, reading, and sending email to receive commands through an actor-controlled mailbox.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.