September 25, 2019 By David Bisson 2 min read

Attackers launched a new campaign that leveraged updated downloaders and a backdoor to distribute samples of the Zebrocy malware family.

On August 20, researchers at ESET spotted a new Zebrocy campaign in which the Sednit group targeted embassies of and ministries of foreign affairs in Eastern European and Central Asian countries. The campaign started with a phishing email that contained a malicious attachment. Once opened, this otherwise blank document downloaded a remote template hosted on Dropbox to execute malicious macros and ultimately load the malware.

ESET came across a few surprises along the way. For instance, researchers found that the Sednit group had rewritten its Delphi downloader in Golang for its latest campaign. This downloader had fewer data-gathering capabilities than the group’s previous downloaders. In addition, researchers observed that the backdoor was now written in Golang and no longer in Delphi.

The Slovakian security firm reasoned that Sednit made these changes to help the campaign’s components more effectively evade detection.

A Look at Zebrocy’s History

The Sednit group has been around since at least 2004, making it one of the more longstanding cyberthreats. ESET had a chance to examine the Zebrocy malware in depth in November 2018, when the security firm found several indicators suggesting that a team less experienced than the Sednit core was responsible for developing the threat and its components. Even so, the malware continued to evolve.

In December 2018, for instance, Palo Alto Networks found a new Go variant of the attack tool. In June 2019, Kaspersky Lab observed Zebrocy using a new downloader to target organizations in Germany, the U.K., Iran, Ukraine and Afghanistan.

How to Defend Against Phishing-Borne Threats

Security professionals can help defend their organizations against phishing-borne threats like Zebrocy by using multifactor authentication (MFA) and identity and access management (IAM) to remedy the weaknesses of password-only authentication for work accounts. Companies should also advocate for phishing simulations that can evaluate their organization’s defenses against an email attack campaign.

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today