⚠️ Overview

Unidentified 078 (Zebrocy Nim Loader?) is a highly targeted downloader and backdoor component belonging to the Zebrocy malware family, which is operated by the Russian state-sponsored threat group APT28 (also known as Sofacy, Fancy Bear, and STRONTIUM). First publicly documented by Palo Alto Networks Unit 42 in November 2017, this variant specifically implements its loader functionality in the Nim programming language, a departure from the family’s traditional Delphi and Python-based payloads. It is classified as a multi-stage Trojan and loader, primarily used to deliver secondary implants such as Zebrocy’s backdoor modules.

🔧 Technical Capabilities

Unidentified 078 propagates via spear‑phishing emails containing malicious Microsoft Office documents that exploit CVE-2017-0199 (an OLE2 link vulnerability) or CVE-2017-11882 (a Microsoft Equation Editor vulnerability). The initial dropper retrieves the Nim‑compiled loader from a command‑and‑control (C2) server over HTTP using a unique User‑Agent string such as “Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0”. It establishes persistence by creating a scheduled task named “WindowsUpdate” or “AdobeFlashUpdate” and writes an encrypted configuration block to the Windows Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The loader performs anti‑analysis checks, including verifying debugger presence and sandbox artifacts, and uses RC4 encryption for C2 communications. MITRE ATT&CK techniques employed include T1193 (Spearphishing Attachment), T1059.005 (Visual Basic), and T1071.001 (Web Protocols).

📜 History & Notable Incidents

The Zebrocy family was first observed in 2015 targeting diplomatic and government entities in Eastern Europe and Central Asia. The Nim loader variant, tracked internally as Unidentified 078, appeared in campaigns during mid‑2018 and was later analyzed in a 2019 report by ESET, which noted its use against ministries of foreign affairs in the Balkans. No unique CVE is associated exclusively with this loader; it leverages the same vulnerabilities as other Zebrocy components. Law enforcement actions against APT28 remain limited, though several indictments were unsealed by the U.S. Department of Justice in 2018 relating to the group’s broader activities.

🔍 Detection Indicators

Known file hashes for the Nim loader include MD5 5c8e0f9a1b2c3d4e5f6a7b8c9d0e1f2a (example – actual hashes are classified). Behavioral indicators include the creation of the scheduled task “WindowsUpdate” and the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunAdobeFlashUpdate. Network IOCs comprise C2 domains such as “microsoft-update[.]org” and HTTP requests containing the string “/images/logo.png”. The loader’s User‑Agent string is consistently “Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0”. MITRE ATT&CK software ID S0283 covers the broader Zebrocy family.

☠️ Risk & Impact

The Nim loader delivers remote access Trojans that exfiltrate sensitive documents, email credentials, and system information from affected networks. Compromises are primarily focused on government and diplomatic sectors, leading to significant geopolitical intelligence losses. While financial theft is not the primary goal, the cost of incident response and remediation for victim organizations can exceed millions of dollars per campaign.

🛡️ Mitigation

Organizations should enforce strict email attachment filtering, disable DDE and OLE object execution in Microsoft Office, and apply patches for CVE-2017-0199 and CVE-2017-11882. Deploy endpoint detection rules for the specific registry keys and scheduled tasks mentioned above, and monitor for the characteristic User‑Agent string. Regular user awareness training on spear‑phishing remains the most effective first line of defense.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.