Loading threat actor…
Zebrocy is a long-running cyber-espionage subgroup and malware cluster associated with Sofacy, also known as APT28 or Fancy Bear, a Russian state-linked threat actor widely tied to the GRU. Active since at least 2015, Zebrocy began as a Sofacy subset centered on post-exploitation malware and later evolved into a broader intrusion set with its own tooling, infrastructure patterns, and targeting cadence. It has been consistently associated with government, diplomatic, and military-related targeting, especially across former Soviet republics, Central Asia, the Middle East, Europe, and parts of Asia. Zebrocy is notable for frequent redevelopment of its malware in multiple programming languages, including Delphi, AutoIT, C#, Go, Python, and later Nim, while preserving a recognizable operational model. Its first-stage implants commonly perform host profiling by collecting system information, running process lists, and screenshots, then exfiltrate that reconnaissance to command-and-control infrastructure. Follow-on activity can include deployment of tailored second-stage implants for credential theft, file theft, and keylogging, indicating a selective post-compromise workflow rather than indiscriminate payloading. Observed delivery methods rely heavily on spearphishing with malicious documents and layered attachment chains. Campaigns have used archive files, shortcut files, embedded scripts, PowerShell, decoy documents, VBA macros, and staged downloaders. A 2018 campaign against Central Asian government-related organizations used a Go-based downloader that profiled victims, retrieved additional payloads, established persistence, and launched an AutoIT-to-Delphi payload chain. A March 2021 cluster targeting Kazakhstan used Delphi malware known as Delphocy delivered through malicious Word documents; the payload functioned as a keylogger by installing a low-level keyboard hook and transmitting captured keystrokes to attacker-controlled infrastructure. Zebrocy has shown sustained interest in Kazakhstan and other Central Asian states, including Kyrgyzstan, Tajikistan, and Azerbaijan, while broader victim geography has included Ukraine, Poland, multiple Middle Eastern states, and additional European and Asian countries. Targeting has repeatedly focused on government-related entities, diplomatic organizations, and in some cases industrial organizations. Reporting has also noted overlap in infrastructure and victimology between Zebrocy and GreyEnergy, including near-simultaneous targeting of the same industrial organization in Kazakhstan, though this indicates operational relationship evidence rather than a merger of identities. The cluster has also been linked to older Delphocy activity and exhibits code lineage and tradecraft overlaps discussed alongside BlackEnergy-related development history. Across campaigns, Zebrocy has demonstrated iterative malware engineering, reuse of familiar reconnaissance logic across language rewrites, and sustained espionage-oriented collection against state and quasi-state targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Sofacy subgroup conducting campaigns focused on former Soviet republics and Asia, including a Kazakhstan-targeted operation using Delphocy malware delivered via malicious Word documents with VBA macros.
A Sofacy subgroup associated with Delphocy malware campaigns, targeting former Soviet republics and more recently Asia. In this reference, Zebrocy is linked to a March 2021 cluster targeting Kazakhstan using malicious Word documents that drop a Delphi-based keylogger/backdoor.
Group associated with Zebrocy malware, targeting Central Asian government-related organizations via spear-phishing and using Linux-based web server infrastructure.
A Sofacy subset involved in post-exploitation and spear-phishing activity, using shared C2 infrastructure with GreyEnergy and targeting the same industrial company in Kazakhstan around the same time.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.