Loading story…
SentinelLabs reported that a Zebrocy campaign linked to Sofacy/APT28 targeted organizations in Kazakhstan with malicious Microsoft Word documents masquerading as materials from Kazchrome. The lure files carried the same VBA macro, which decoded a base64-encoded Delphi payload named wininition.exe; once executed, the malware acted as a keylogger by installing a low-level keyboard hook. Two of the six analyzed documents were likely uploaded to VirusTotal from Kazakhstan by victims, indicating the lures were opened in the intended geography.
The investigation identified two likely compromised domains used as command-and-control infrastructure and tied the activity to Zebrocy’s established tradecraft. SentinelLabs also documented methods for reversing the password-protected VBA macros and analyzing the Delphi malware with tools including IDR and Ghidra, and published hashes, URLs, and YARA rules to support detection and threat hunting for related intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published a detailed analysis attributing the activity to Sofacy/APT28's Zebrocy subgroup, describing the Delphocy keylogger behavior, identifying likely compromised command-and-control domains, and releasing hashes and YARA rules for threat hunting.
During the March 2021 campaign, two of the six malicious lure documents appear to have been uploaded to VirusTotal from Kazakhstan, suggesting local victim interaction with the files.
In March 2021, a Zebrocy-linked campaign targeted entities in Kazakhstan using Microsoft Word lure documents impersonating Kazchrome materials. The documents delivered a Delphi payload named wininition.exe via embedded VBA macros.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Zebrocy** malware campaign linked to **Sofacy / APT28 (Fancy Bear)** that used malicious Microsoft Word documents with embedded **VBA macros** to deliver a Delphi-written payload, `wininition.exe`. SentinelLabs traced a March 2021 cluster targeting **Kazakhstan**, including six lure documents that shared the same macro logic; two samples appeared to have been uploaded from victim environments in the country. Once executed, the payload installed a low-level keyboard hook to capture keystrokes and exfiltrated the data to command-and-control infrastructure hosted on apparently compromised domains. The reporting aligns with earlier research showing Zebrocy’s evolving, **multilanguage** toolset and flexible delivery methods. Analysts said the operation combined document-based initial access with malware written in multiple languages, including Delphi, and used reverse-engineering techniques to unpack password-protected macros and inspect the payload. The investigation also uncovered additional Zebrocy clusters and produced **indicators of compromise** and **YARA rules** to help defenders detect related activity.
Aug 15, 2026
A Sofacy-linked **Zebrocy** campaign targeted government, diplomatic, and related organizations across Central Asia, Europe, the Middle East, and Asia with spearphishing emails carrying layered malware attachments. Reported targets included entities in **Kazakhstan, Kyrgyzstan, Azerbaijan, and Tajikistan**, with lures using shortcut files, archives, decoy documents, PowerShell scripts, and base64-encoded payloads to begin the infection chain. The operation introduced a new downloader written in **Go** that gathered detailed system information, sent it to a hardcoded command-and-control server, then retrieved additional **Zebrocy AutoIT/Delphi** payloads, established persistence, and deleted itself. Researchers said the activity showed both rising campaign volume and continued malware development within the Zebrocy cluster, even as more traditional Sofacy **SPLM/XAgent** activity appeared to be declining.
Aug 14, 2026
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026