Trojan.MSIL.Zapchast.gen

Trojan.MSIL.Zapchast.gen is a spyware-class malware family/detection name referenced in reporting on active exploitation of Dassault Systèmes Delmia Apriso vulnerabilities in 2025. Public reporting cited by CISA-linked coverage states that SANS researcher Johannes Ullrich observed attackers exploiting Delmia Apriso CVE-2025-5086 to download a DLL named fwitxz01.dll, which some antivirus vendors flagged as malicious and which Kaspersky classifies as Trojan.MSIL.Zapchast.gen. The malware is described as supporting cyber-espionage activity, including keylogging, screenshot capture, and collection of active application lists. The reported infection vector in the provided content is delivery via exploitation of the Delmia Apriso deserialization vulnerability CVE-2025-5086; the broader campaign context also includes exploitation of Delmia Apriso CVE-2025-6204 and CVE-2025-6205. The affected environment discussed in the source material is manufacturing operations management infrastructure, where Delmia Apriso is used to control physical manufacturing processes. Organizations mentioned as users of the platform include RTX, Lockheed Martin, L'Oréal, Electrolux, and Spirit AeroSystems. A specific indicator mentioned in the content is the downloaded payload filename fwitxz01.dll. No threat actor attribution beyond unspecified attackers/hackers is provided in the content.