LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0251: Zebrocy

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. [1][2][3][4]

EnterpriseS0251MalwareObject v3.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0251: Zebrocy describes [Zebrocy](https://attack.mitre.org/software/S0251) is a Trojan that has been used by [APT28](https://attack.mitre.org/groups/G0007) since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: CISA Zebrocy Oct 2020)

Executive priority

S0251: Zebrocy is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0251: Zebrocy by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0251: Zebrocy appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Zebrocy

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. [1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

31 rows
DomainIDNameRelationship / procedure
EnterpriseT1124System Time Discovery

Zebrocy gathers the current time zone and date information from the system.CitationESET Zebrocy Nov 2018[4]

EnterpriseT1057Process Discovery

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.[2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019[5]

EnterpriseT1047Windows Management Instrumentation

One variant of Zebrocy uses WMI queries to gather information.[3]

EnterpriseT1049System Network Connections Discovery

Zebrocy uses netstat -aon to gather network connection information.CitationESET Zebrocy May 2019

EnterpriseT1105Ingress Tool Transfer

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.[1][2]CitationESET Zebrocy May 2019[5]

EnterpriseT1113Screen Capture

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.[2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019[5][4]

EnterpriseT1120Peripheral Device Discovery

Zebrocy enumerates information about connected storage devices.[2]

EnterpriseT1033System Owner/User Discovery

Zebrocy gets the username from the system.CitationESET Zebrocy Nov 2018[4]

EnterpriseT1056.004Credential API HookingSub-technique

Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.CitationSecurelist Sofacy Feb 2018

EnterpriseT1041Exfiltration Over C2 Channel

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.[5][4]

EnterpriseT1082System Information Discovery

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information. [1][2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019[5][4]

EnterpriseT1071.003Mail ProtocolsSub-technique

Zebrocy uses SMTP and POP3 for C2.[1][2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019

EnterpriseT1071.001Web ProtocolsSub-technique

Zebrocy uses HTTP for C2.[1][2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019[5]

EnterpriseT1016System Network Configuration Discovery

Zebrocy runs the ipconfig /all command.CitationESET Zebrocy May 2019

EnterpriseT1083File and Directory Discovery

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory.CitationSecurelist Sofacy Feb 2018CitationESET Zebrocy Nov 2018CitationESET Zebrocy May 2019 Zebrocy can obtain the current execution path as well as perform drive enumeration.[5][4]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.CitationESET Zebrocy Nov 2018CitationESET Zebrocy May 2019[5]

EnterpriseT1027.002Software PackingSub-technique

Zebrocy's Delphi variant was packed with UPX.[3][5]

EnterpriseT1680Local Storage Discovery

Zebrocy collects the serial number for the storage volume C:\.[1][2]CitationESET Zebrocy Nov 2018[3]CitationESET Zebrocy May 2019[5][4]

EnterpriseT1560Archive Collected Data

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration. CitationSecurelist Sofacy Feb 2018CitationESET Zebrocy Nov 2018[4]

EnterpriseT1037.001Logon Script (Windows)Sub-technique

Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.CitationESET Zebrocy Nov 2018

EnterpriseT1059.003Windows Command ShellSub-technique

Zebrocy uses cmd.exe to execute commands on the system.CitationESET Zebrocy May 2019[4]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Zebrocy uses SSL and AES ECB for encrypting C2 communications.CitationESET Zebrocy Nov 2018CitationESET Zebrocy May 2019[4]

EnterpriseT1074.001Local Data StagingSub-technique

Zebrocy stores all collected information in a single file before exfiltration.CitationESET Zebrocy Nov 2018

EnterpriseT1012Query Registry

Zebrocy executes the reg query command to obtain information in the Registry.CitationESET Zebrocy May 2019

EnterpriseT1070.004File DeletionSub-technique

Zebrocy has a command to delete files and directories.CitationESET Zebrocy Nov 2018CitationESET Zebrocy May 2019[4]

EnterpriseT1132.001Standard EncodingSub-technique

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.[5]

EnterpriseT1135Network Share Discovery

Zebrocy identifies network drives when they are added to victim systems.CitationSecurelist Sofacy Feb 2018

EnterpriseT1140Deobfuscate/Decode Files or Information

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.[2]CitationESET Zebrocy Nov 2018

EnterpriseT1119Automated Collection

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.CitationESET Zebrocy Nov 2018CitationESET Zebrocy May 2019

EnterpriseT1053.005Scheduled TaskSub-technique

Zebrocy has a command to create a scheduled task for persistence.[4]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.CitationESET Zebrocy May 2019

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Relationship explorer

All related ATT&CK context

uses · GroupG0007: APT28Enterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1056.004: Credential API HookingEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1037.001: Logon Script (Windows)Enterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
3.1
Created
Modified
Raw hash
82f36f10b4ed3c72...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.23.1Current bundle82f36f10b4ed…
19.13.1Older bundle82f36f10b4ed…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  2. [2]
    Unit42 Cannon Nov 2018

    Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.

    Open source URL
  3. [3]
    Unit42 Sofacy Dec 2018

    Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.

    Open source URL
  4. [4]
    CISA Zebrocy Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.

    Open source URL
  5. [5]
    Accenture SNAKEMACKEREL Nov 2018

    Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.

    Open source URL
  6. [6]
    CyberScoop APT28 Nov 2018

    Shoorbajee, Z. (2018, November 29). Accenture: Russian hackers using Brexit talks to disguise phishing lures. Retrieved July 16, 2019.

    Open source URL
  7. [7]
    Zebrocy

    (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)

  8. [8]
    Zekapab

    (Citation: CyberScoop APT28 Nov 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)

  9. [9]
    mitre-attackS0251
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use