Sofacy Group’s Parallel Attacks - Palo Alto Networks Blog

The Unit 42 blog documents Sofacy's parallel attack campaigns in 2018 that broadly target government and diplomatic organizations via spear-phishing and weaponized Office documents. The actor delivered the Zebrocy downloader in multiple language variants and, in at least one instance, deployed the open-source Koadic post-exploitation framework; the report highlights DDE-based document abuse, unique user-agent strings, C2 infrastructure, and provides extensive IoCs for detection.