Sofacy

Sofacy is a threat actor group that has been observed using multiple languages to create variants of the Zebrocy Trojan and Cannon. In one campaign, they relied heavily on filenames to lure victims into launching weaponized documents. The group packed only Delphi variants in an attempt to increase evasion, and it has been speculated that this was done due to the known and widely analyzed nature of the Delphi variant of Zebrocy. The Sofacy group has been known to use IP-based command-and-control servers, and examining the infrastructure did not reveal significant overlap or relationships with previous Zebrocy or Sofacy infrastructure. Their presence in the DNC network alongside APT29 brought attention to their activities in 2016, and they later targeted the Olympics and the World Anti-Doping Agency and Court of Arbitration for Sports by compromising individuals and servers via phishing attacks. To protect against Sofacy's activities, it is recommended to review logins and unusual administrator access on systems, thoroughly scan and sandbox incoming attachments, and maintain two-factor authentication for services like email and VPN access. However, Palo Alto Networks customers are already protected from the threat posed by Sofacy's Zebrocy and Cannon campaigns.