Loading story…
A Sofacy-linked Zebrocy campaign targeted government, diplomatic, and related organizations across Central Asia, Europe, the Middle East, and Asia with spearphishing emails carrying layered malware attachments. Reported targets included entities in Kazakhstan, Kyrgyzstan, Azerbaijan, and Tajikistan, with lures using shortcut files, archives, decoy documents, PowerShell scripts, and base64-encoded payloads to begin the infection chain.
The operation introduced a new downloader written in Go that gathered detailed system information, sent it to a hardcoded command-and-control server, then retrieved additional Zebrocy AutoIT/Delphi payloads, established persistence, and deleted itself. Researchers said the activity showed both rising campaign volume and continued malware development within the Zebrocy cluster, even as more traditional Sofacy SPLM/XAgent activity appeared to be declining.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2019-08-20, Sednit/APT28 targeted embassies and Ministries of Foreign Affairs in Eastern European and Central Asian countries with Zebrocy spearphishing. The intrusion used a new Nim downloader, a Golang downloader, and a new Golang Zebrocy backdoor, marking an expansion of the group’s tooling beyond earlier Delphi-based implants.
In early June 2018, Zebrocy spearphished more than a half-dozen accounts targeting several Central Asian diplomatic organizations. A lure in this activity used the archive path "2018-05-Invitation-Letter(1).rar//2018-05-Invitation-Letter(pril).docx".
Starting in May 2018, Zebrocy spearphished Central Asian government-related targets with a new Go-based downloader. One observed campaign used the archive attachment name "30-144.arj" containing a disguised executable.
The report says Zebrocy increased in activity volume and malware innovation during 2018 while traditional Sofacy SPLM/XAgent activity declined. It also notes continued targeting of Central Asian government-related organizations and a new Middle Eastern diplomatic target.
The analyzed AutoIT dropper wrote a Delphi payload consistent with Zebrocy behavior that the report says had been observed since November 2015.
The report states that Zebrocy was initially introduced as a Sofacy backdoor package in 2015, marking the start of this malware cluster's activity within the Sofacy ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs reported that a **Zebrocy** campaign linked to **Sofacy/APT28** targeted organizations in Kazakhstan with malicious Microsoft Word documents masquerading as materials from **Kazchrome**. The lure files carried the same VBA macro, which decoded a base64-encoded Delphi payload named `wininition.exe`; once executed, the malware acted as a keylogger by installing a low-level keyboard hook. Two of the six analyzed documents were likely uploaded to VirusTotal from Kazakhstan by victims, indicating the lures were opened in the intended geography. The investigation identified two likely compromised domains used as command-and-control infrastructure and tied the activity to Zebrocy’s established tradecraft. SentinelLabs also documented methods for reversing the password-protected VBA macros and analyzing the Delphi malware with tools including **IDR** and **Ghidra**, and published hashes, URLs, and **YARA** rules to support detection and threat hunting for related intrusions.
Jun 29, 2026
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026
Researchers detailed a **Zebrocy** malware campaign linked to **Sofacy / APT28 (Fancy Bear)** that used malicious Microsoft Word documents with embedded **VBA macros** to deliver a Delphi-written payload, `wininition.exe`. SentinelLabs traced a March 2021 cluster targeting **Kazakhstan**, including six lure documents that shared the same macro logic; two samples appeared to have been uploaded from victim environments in the country. Once executed, the payload installed a low-level keyboard hook to capture keystrokes and exfiltrated the data to command-and-control infrastructure hosted on apparently compromised domains. The reporting aligns with earlier research showing Zebrocy’s evolving, **multilanguage** toolset and flexible delivery methods. Analysts said the operation combined document-based initial access with malware written in multiple languages, including Delphi, and used reverse-engineering techniques to unpack password-protected macros and inspect the payload. The investigation also uncovered additional Zebrocy clusters and produced **indicators of compromise** and **YARA rules** to help defenders detect related activity.
Aug 15, 2026