From 2893d715d6c421e05700c340dfdfe50a3942f5ea Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 4 Oct 2018 10:52:40 +0200 Subject: [PATCH] Add ZEBROCY tool --- clusters/tool.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/clusters/tool.json b/clusters/tool.json index 90386e7..794c7fd 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -5853,7 +5853,17 @@ "type": "similar" } ] + }, + { + "value": "ZEBROCY", + "description": "ZEBROCY is a tool used by APT28, which has been observed since late 2015. The communications module used by ZEBROCY transmits using HTTP. The implant has key logging and file exfiltration functionality and utilises a file collection capability that identifies files with particular extensions.", + "meta": { + "refs": [ + "https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28" + ] + }, + "uuid": "8a2ae47a-c7b2-11e8-b223-ab4d8f78f3ef" } ], - "version": 90 + "version": 91 }