In August 2018, Sednit’s operators deployed two new Zebrocy components, and since then we have seen an uptick in Zebrocy deployments. Zebrocy is a set of downloaders, droppers and backdoors; while downloaders and droppers are doing reconnaissance, backdoors implement persistence and spying activities against the target. These new components use a an unusual way to exfiltrate gathered information by using protocols related to mail services such as SMTP and POP3