Zebrocy
Software · ATTACK:enterprise:S0251
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0251",
"title": "Zebrocy",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0251",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a4f57468-fbd5-49e4-8476-52088220b92d",
"external_id": "S0251",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2025-10-22T02:49:35.030Z",
"version": "3.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Zekapab"
},
{
"source_name": "Zebrocy"
},
{
"source_name": "Accenture SNAKEMACKEREL Nov 2018",
"url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
},
{
"source_name": "CISA Zebrocy Oct 2020",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"
},
{
"source_name": "Unit42 Cannon Nov 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
},
{
"source_name": "Unit42 Sofacy Dec 2018",
"url": "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"
},
{
"source_name": "Palo Alto Sofacy 06-2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
},
{
"source_name": "CyberScoop APT28 Nov 2018",
"url": "https://www.cyberscoop.com/apt28-brexit-phishing-accenture/"
}
]
}Explicit source assertions (32)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07eea18c-048c-4187-a6f1-ca97e9bfc846
ESET Zebrocy Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1051f320-91fa-4f89-8abe-a851a56e18a7
Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e1d79d-1eb9-4ce7-a21e-115ce2a414f1
Unit42 Sofacy Dec 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1df5eebc-94f5-44ae-8feb-8d3a89fbfc4e
ESET Zebrocy May 2019ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24bf6b49-b492-44b0-bcc9-37bfba489d62
Palo Alto Sofacy 06-2018 · Unit42 Cannon Nov 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e2d4ce8-0006-4571-b8ea-dbfc4bf7302f
Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45f3afcd-d0b7-494b-a61a-cad724dbf72a
Unit42 Cannon Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46452566-0f0f-4fe9-9cef-ef7e3d6eee36
ESET Zebrocy Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1056.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f550078-32b1-4abb-aa90-0e9fb7cc45f9
Securelist Sofacy Feb 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--546fc347-7844-4721-8ec4-dbf45e8ca1e7
Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6216dadc-095e-4550-bc01-79c79fe614ba
Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020 · ESET Zebrocy May 2019 · ESET Zebrocy Nov 2018 · Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018 · Palo Alto Sofacy 06-2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1071.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68a91212-caee-45f3-ba09-95ed43f80af6
ESET Zebrocy May 2019 · ESET Zebrocy Nov 2018 · Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018 · Palo Alto Sofacy 06-2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d102ef8-c831-413d-b2cb-392517638b0b
Palo Alto Sofacy 06-2018 · Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c18e59d-3448-462c-aaa7-bf03b9ea5780
ESET Zebrocy May 2019ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86b7bab7-a1d6-4820-be55-c379f3967f1a
Securelist Sofacy Feb 2018 · ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8839b4ad-24cb-4ad3-a407-947f75591973
ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--895a3c63-26d1-4846-8b8d-8f6b2c266910
Unit42 Sofacy Dec 2018 · Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--912fc001-4c47-42fb-a2c0-7abed4e620b1
Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020 · ESET Zebrocy May 2019 · ESET Zebrocy Nov 2018 · Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018 · Palo Alto Sofacy 06-2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--960accee-d5ea-4570-8697-84ada0cc266a
Securelist Sofacy Feb 2018 · ESET Zebrocy Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0f218db-2d79-43b7-b2b8-ef1199ada766
ESET Zebrocy Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7cd3903-1b6d-4163-b7cf-97dbdeefda05
ESET Zebrocy May 2019 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcb137f0-e92d-47b5-912f-ba8d4f9ff15c
ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4a2a14a-6fb0-46cf-b97d-c4bcb1c751a7
ESET Zebrocy Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4e03a2f-3617-4017-8dab-8904b1060c87
ESET Zebrocy May 2019ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c56a229c-f033-4a51-ad5c-251dff28b87e
ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019 · CISA Zebrocy Oct 2020ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0251
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2fa6899-2529-45b1-86bf-f2c5475a2ea6
Palo Alto Sofacy 06-2018 · Unit42 Cannon Nov 2018 · Securelist Sofacy Feb 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d514d73a-27de-409d-bff9-d7e48f2859a6
Accenture SNAKEMACKEREL Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e27ebd5b-4ed3-4c04-96e3-026bd127ed64
Securelist Sofacy Feb 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3be5269-92fd-488e-be35-ddc91030f7c3
Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9a4ceb4-ed33-48c4-b1f3-f73883b0e207
ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f957f429-c0d1-4b02-aef8-1d8500421225
CISA Zebrocy Oct 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd9b9c3a-544b-43e1-b4f4-aab6e646eb31
ESET Zebrocy May 2019