Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?



Russian Cyberspies Build ‘Go’ Version of Their Trojan

The Russian-linked cyber-espionage group Sofacy has developed a new version of their Zebrocy tool using the Go programming language, Palo Alto Networks security researchers warn.

The Russian-linked cyber-espionage group Sofacy has developed a new version of their Zebrocy tool using the Go programming language, Palo Alto Networks security researchers warn.

The first-stage malware was initially analyzed in April this year, and has been observed in numerous attacks in October and November. Last month, however, the researchers also observed a new Trojan being used in the group’s attacks.

Also known as APT28, Fancy Bear, Pawn Storm, Sednit and Strontium, the state-sponsored actor has been active for several years, focusing on cyber-espionage and believed to have orchestrated the attacks targeting the 2016 presidential election in the United States. 

The group hit Ukraine and NATO countries over the past years, but a recent report revealed governmental targets on four continents. An October report from Kaspersky revealed that the activities of various nation-state Russian groups started to overlap.

The group has used different programming languages to build functionally similar Trojans before, and the Zebrocy tool went through this process as well, with numerous variants developed in AutoIt, Delphi, VB.NET, C# and Visual C++ already observed.

The recently discovered Go variant of Zebrocy has been already used in attacks, the researchers say. One of the incidents occurred on October 11 and employed a spear-phishing email with an LNK attachment that would run a series of PowerShell scripts to extract a payload. The scripts, however, were coded incorrectly and the payload wasn’t installed.

The same Trojan variant was also delivered as part of a campaign running from mid-October through mid-November, and which used 9 delivery documents that had the same author name, Joohn. The documents would fetch a remote template and trick the victim into allowing a malicious macro to run.

Advertisement. Scroll to continue reading.

The Go variant of Zebrocy does initial information collection on the compromised system, sends the data to the command and control (C&C) server, and attempts to download, install and execute a payload from it. It also shows additional specific overlaps in functionality with other tool variants, including the use of a shared C&C URL.

The malware attempts to evade automated malware analysis, and uses HTTP POST requests to interact with its C&C server. The system data it collects includes a list of running processes, information gathered via the ”systeminfo” command, local disk information, and a screenshot of the desktop.

If the server responds with an encoded payload, the malware saves it to disk, and creates an auto run registry key to ensure the payload is executed at user login. The secondary payload was found to be another Trojan written in the Go language, also meant to download additional tools onto the compromised system, Palo Alto Networks says.

“The Sofacy group continues to use variants of the Zebrocy payload in its attack campaigns. It is also apparent that the Sofacy group will use these new variants of Zebrocy across multiple different campaigns, as the Go variant of Zebrocy was delivered via the LNK shortcut and a Dear Joohn delivery document,” Palo Alto Networks concludes.

Related: Russia-Linked Phishing Attacks Hit Government Agencies on Four Continents

Related: Infamous Russian Hacking Group Used New Trojan in Recent Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.


The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...