Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-02 12:24:15 UTC
Home > List all groups > List all tools > List all groups using tool Zebrocy
 Tool: Zebrocy
Names
Zebrocy
Zekapab
Category Malware
Type Backdoor, Info stealer, Exfiltration, Tunneling
Description
Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The
malware comes in several programming language variants, including C++, Delphi,
AutoIt, C#, and VB.NET.
Information
MITRE ATT&CK Malpedia
Last change to this tool card: 21 April 2021
Download this tool card in JSON format
All groups using tool Zebrocy
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1be50485-7c9f-45dc-96b5-1cd8d2977a0e
Page 1 of 2

Changed Name Country Observed
APT groups
  Sofacy, APT 28, Fancy Bear, Sednit 2004-Apr 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1be50485-7c9f-45dc-96b5-1cd8d2977a0e
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1be50485-7c9f-45dc-96b5-1cd8d2977a0e
Page 2 of 2