{"id":59814,"date":"2025-09-26T10:54:23","date_gmt":"2025-09-26T10:54:23","guid":{"rendered":"https:\/\/becolve.com\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/"},"modified":"2025-09-26T10:54:23","modified_gmt":"2025-09-26T10:54:23","slug":"zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/","title":{"rendered":"Zebrocy. A new APT group affecting ICS environments and government agencies?"},"content":{"rendered":"

In November 2014, we published this entry<\/a> in which we described how the APT Sandworm<\/strong> (mainly through the BlackEnergy group) affected transactional systems of government bodies (NATO, Ukrainian government, etc…) between June and October 2014 and how between November 2014 and the first months of 2015 it used certain SCADA<\/strong> systems (CIMPLICITY HMI mainly) as an attack vector to compromise industrial environments.<\/p>\n

A few years later, in October 2018, the company ESET<\/strong> published this report<\/a> which included the activity of the so-called GreyEnergy group, as the successor to the BlackEnergy group. GreyEnergy also acted by exploiting vulnerabilities in industrial systems, located mainly in Ukraine. <\/p>\n

On the other hand, the APT group<\/strong> called Sofacy (or APT28)<\/a> is known for its cyber espionage activities. Recently, Kaspersky has identified an overlap between the working methods of the GreyEnergy and Sofacy groups<\/a>, calling this emerging group Zebrocy.<\/a> <\/p>\n

Zebrocy’s targets are government companies located in different countries in the Middle East, Europe, and Asia.<\/p>\n

The main discovery made is that both GreyEnery and Sofacy are using the same servers at the same time and targeted similar organizations.<\/p>\n

Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged? <\/p><\/blockquote>\n

We show below some interesting details.<\/p>\n

C2 servers used by both Zebrocy and GreyEnergy:<\/strong><\/strong> It has been shown that these servers have been used interchangeably by both groups:<\/p>\n

    \n
  1. Server 193.23.181[.]151<\/strong> used by Zebrocy and GreyEnergy in June 2018.<\/li>\n
  2. Server 185.217.0[.]124<\/strong> used by GreyEnergy between May and June 2018 and by Zebrocy in June 2018.<\/li>\n<\/ol>\n

    Common document used by Zebrocy and GreyEnergy to conduct a spearfishing campaign called \u201cSeminar.rtf\u201d.<\/strong><\/p>\n

    \"\"<\/p>\n

    Common target of both groups:<\/strong> Companies in the industrial and government sectors of Kazakhstan.<\/p>\n

    \"\"<\/p>\n

    After these evidences, the relationship between GreyEnergy and a possible split from Sofacy, which has been called Zebrocy, seems probable.<\/p>\n

    If you need more information about the APT groups that target industrial environments and\/or critical infrastructures and you need to know what countermeasures you can implement to mitigate their possible consequences in the event of security incidents, please contact us.<\/a><\/p>\n

    Source: Karpesky Lab ICS CERT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged? <\/p>\n","protected":false},"author":31,"featured_media":59817,"menu_order":0,"template":"","categories":[1371],"tags":[],"arquitectura":[1839],"area":[],"sector":[],"experto":[1396],"weborigen":[157],"productos-tax":[],"soluciones-tax":[],"marcas-tax":[],"coauthors":[],"class_list":["post-59814","blog","type-blog","status-publish","has-post-thumbnail","hentry","category-cybersecurity","arquitectura-industrial-cybersecurity","experto-industrial-cybersecurity-total-availability","weborigen-ciberseguridadlogitek-com"],"acf":[],"yoast_head":"\nZebrocy. A new APT group affecting ICS environments and government agencies?<\/title>\n<meta name=\"description\" content=\"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Zebrocy. A new APT group affecting ICS environments and government agencies?\" \/>\n<meta property=\"og:description\" content=\"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/\" \/>\n<meta property=\"og:site_name\" content=\"Becolve Digital\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ciberseguridadlogitek.com\/wp-content\/uploads\/grey-ciberseguridad-logitek.jpg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Logitek_es\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Becolve Digital\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/\",\"name\":\"Zebrocy. A new APT group affecting ICS environments and government agencies?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/grey-ciberseguridad-logitek.jpg\",\"datePublished\":\"2025-09-26T10:54:23+00:00\",\"description\":\"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/#primaryimage\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/grey-ciberseguridad-logitek.jpg\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/grey-ciberseguridad-logitek.jpg\",\"width\":800,\"height\":300},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog Items\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Zebrocy. A new APT group affecting ICS environments and government agencies?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"name\":\"Becolve Digital\",\"description\":\"Transformaci\u00f3n digital en industria e infraestructuras\",\"publisher\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/becolve.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\",\"name\":\"Becolve Digital\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"width\":200,\"height\":64,\"caption\":\"Becolve Digital\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Logitek_es\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/becolve-digital\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Zebrocy. A new APT group affecting ICS environments and government agencies?","description":"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/","og_locale":"en_US","og_type":"article","og_title":"Zebrocy. A new APT group affecting ICS environments and government agencies?","og_description":"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?","og_url":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/","og_site_name":"Becolve Digital","og_image":[{"url":"https:\/\/www.ciberseguridadlogitek.com\/wp-content\/uploads\/grey-ciberseguridad-logitek.jpg","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_site":"@Logitek_es","twitter_misc":{"Est. reading time":"2 minutes","Written by":"Becolve Digital"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/","url":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/","name":"Zebrocy. A new APT group affecting ICS environments and government agencies?","isPartOf":{"@id":"https:\/\/becolve.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/#primaryimage"},"image":{"@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/#primaryimage"},"thumbnailUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/grey-ciberseguridad-logitek.jpg","datePublished":"2025-09-26T10:54:23+00:00","description":"Is there really an overlap between the TTPs (Tactics, Techniques, and Procedures) of GreyEnergy and Sofacy? Has a new group called Zebrocy really emerged?","breadcrumb":{"@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/#primaryimage","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/grey-ciberseguridad-logitek.jpg","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/grey-ciberseguridad-logitek.jpg","width":800,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/becolve.com\/en\/blog\/zebrocy-a-new-apt-group-affecting-ics-environments-and-government-agencies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/becolve.com\/en\/"},{"@type":"ListItem","position":2,"name":"Blog Items","item":"https:\/\/becolve.com\/en\/blog\/"},{"@type":"ListItem","position":3,"name":"Zebrocy. A new APT group affecting ICS environments and government agencies?"}]},{"@type":"WebSite","@id":"https:\/\/becolve.com\/en\/#website","url":"https:\/\/becolve.com\/en\/","name":"Becolve Digital","description":"Transformaci\u00f3n digital en industria e infraestructuras","publisher":{"@id":"https:\/\/becolve.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/becolve.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/becolve.com\/en\/#organization","name":"Becolve Digital","url":"https:\/\/becolve.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","width":200,"height":64,"caption":"Becolve Digital"},"image":{"@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Logitek_es","https:\/\/www.linkedin.com\/company\/becolve-digital\/"]}]}},"_links":{"self":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/59814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/users\/31"}],"version-history":[{"count":0,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/59814\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media\/59817"}],"wp:attachment":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media?parent=59814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/categories?post=59814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/tags?post=59814"},{"taxonomy":"arquitectura","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/arquitectura?post=59814"},{"taxonomy":"area","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/area?post=59814"},{"taxonomy":"sector","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/sector?post=59814"},{"taxonomy":"experto","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/experto?post=59814"},{"taxonomy":"weborigen","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/weborigen?post=59814"},{"taxonomy":"productos-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/productos-tax?post=59814"},{"taxonomy":"soluciones-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/soluciones-tax?post=59814"},{"taxonomy":"marcas-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/marcas-tax?post=59814"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/coauthors?post=59814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}