NativeZone
- ID
- S0637
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
NativeZone is the name given collectively to disposable custom Cobalt Strike loaders used by APT29 since at least 2021.[1][2]
Techniques used (6)
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 Malicious File
- T1218.011 Rundll32
- T1480 Execution Guardrails
- T1497.001 System Checks