Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Sofacy Creates New ‘Go’ Variant of Zebrocy Tool

Summary: Unit 42 reports that the Sofacy threat group built a new Go-language variant of its Zebrocy Trojan, adding to prior versions written in AutoIt, Delphi, VB.NET, C#, and Visual C++. Two delivery attempts were observed: an October 11, 2018 spear-phishing email with an LNK shortcut that failed because the script referenced the wrong filename, and a later document tied to the Dear Joohn campaign that pulled a remote template through a bit.ly link visited 75 times, mostly from Turkey.

What you should know: The Go variant shares a command-and-control URL with two earlier Delphi-written Zebrocy samples, so infrastructure the group already used ties the new language to the same operation. The failed October attack still exposed the full toolchain, including a hardcoded 6,924,764-byte payload offset inside the LNK file.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related