Dear Joohn

Dear Joohn is a phishing campaign associated with the Russia-linked Sofacy threat group and its Zebrocy malware ecosystem. The campaign is notable for delivering a Go-based Zebrocy variant through malicious Microsoft Word content that retrieved a remote template containing a macro, leading to deployment of a multi-stage downloader chain. The activity reflects Sofacy’s broader practice of re-implementing Zebrocy tooling across multiple programming languages, including AutoIt, Delphi, VB.NET, C#, Visual C++, and Go, to diversify tradecraft and complicate detection. In this campaign, the initial document triggered execution of a macro-enabled template that unpacked and launched a Go Zebrocy downloader. The malware conducted host reconnaissance, collected process and system information, captured screenshots, and transmitted collected data to command-and-control infrastructure. It then retrieved and executed additional payloads, demonstrating a staged post-compromise architecture. Persistence was established through a Windows Run key, and the tooling showed basic anti-analysis behavior by altering network behavior when executed under an unexpected filename. The Dear Joohn activity aligns with Sofacy’s long-running espionage operations, particularly its use of spear-phishing, malicious documents, downloader chains, reconnaissance, exfiltration, and persistence mechanisms. Zebrocy has historically been used by Sofacy as a flexible malware family for intelligence collection and follow-on payload delivery.