Loading story…
Researchers detailed a Zebrocy malware campaign linked to Sofacy / APT28 (Fancy Bear) that used malicious Microsoft Word documents with embedded VBA macros to deliver a Delphi-written payload, wininition.exe. SentinelLabs traced a March 2021 cluster targeting Kazakhstan, including six lure documents that shared the same macro logic; two samples appeared to have been uploaded from victim environments in the country. Once executed, the payload installed a low-level keyboard hook to capture keystrokes and exfiltrated the data to command-and-control infrastructure hosted on apparently compromised domains.
The reporting aligns with earlier research showing Zebrocy’s evolving, multilanguage toolset and flexible delivery methods. Analysts said the operation combined document-based initial access with malware written in multiple languages, including Delphi, and used reverse-engineering techniques to unpack password-protected macros and inspect the payload. The investigation also uncovered additional Zebrocy clusters and produced indicators of compromise and YARA rules to help defenders detect related activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers observed a Zebrocy-linked cluster in March 2021 targeting Kazakhstan using six malicious Word documents that dropped a Delphi-written payload named wininition.exe. Two of the samples appeared to have been uploaded by victims in Kazakhstan.
The SentinelLabs reference states that Sofacy, also known as Fancy Bear or APT28, has been active since 2008 targeting governments, military organizations, and private organizations.
Analysis of the March 2021 documents led researchers to discover additional Zebrocy clusters. The SentinelLabs report also published indicators of compromise and YARA rules for the Delphocy payloads and dropper documents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs reported that a **Zebrocy** campaign linked to **Sofacy/APT28** targeted organizations in Kazakhstan with malicious Microsoft Word documents masquerading as materials from **Kazchrome**. The lure files carried the same VBA macro, which decoded a base64-encoded Delphi payload named `wininition.exe`; once executed, the malware acted as a keylogger by installing a low-level keyboard hook. Two of the six analyzed documents were likely uploaded to VirusTotal from Kazakhstan by victims, indicating the lures were opened in the intended geography. The investigation identified two likely compromised domains used as command-and-control infrastructure and tied the activity to Zebrocy’s established tradecraft. SentinelLabs also documented methods for reversing the password-protected VBA macros and analyzing the Delphi malware with tools including **IDR** and **Ghidra**, and published hashes, URLs, and **YARA** rules to support detection and threat hunting for related intrusions.
Jun 29, 2026
A Sofacy-linked **Zebrocy** campaign targeted government, diplomatic, and related organizations across Central Asia, Europe, the Middle East, and Asia with spearphishing emails carrying layered malware attachments. Reported targets included entities in **Kazakhstan, Kyrgyzstan, Azerbaijan, and Tajikistan**, with lures using shortcut files, archives, decoy documents, PowerShell scripts, and base64-encoded payloads to begin the infection chain. The operation introduced a new downloader written in **Go** that gathered detailed system information, sent it to a hardcoded command-and-control server, then retrieved additional **Zebrocy AutoIT/Delphi** payloads, established persistence, and deleted itself. Researchers said the activity showed both rising campaign volume and continued malware development within the Zebrocy cluster, even as more traditional Sofacy **SPLM/XAgent** activity appeared to be declining.
Aug 14, 2026
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026