Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-07

Zigzag Hail

As of 2026-10-28, Zigzag Hail is a threat actor tracked by Threadlinqs Intelligence across 7 threats spanning apt, malware. ATT&CK coverage spans 64 techniques across 12 tactics in 7 of 7 tracked threats. Most-observed techniques: T1082 (System Information Discovery), T1140 (Deobfuscate/Decode Files or Information), T1204.002 (Malicious File).

Tracked threats
77 high
First seen
2026-07-13
Last seen
2026-10-28
ATT&CK techniques
64across 7 of 7 threats
Related CVEs
5Referenced by its activity
7 tracked threat(s) · Categories: APT, MALWARE

Activity timeline

Zigzag Hail appears in 7 tracked threats between and ; the busiest month was 2026-10 with 3 reports.

ATT&CK techniques observed

64 techniques observed across 7 of 7 tracked threats · Stealth (formerly Defense Evasion) (13), Command and Control (10), Execution (9), Resource Development (9), Persistence (6), Discovery (4)
  • T1082 System Information Discovery — Discoveryobserved in 7 of 7 tracked threats
  • T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 6 of 7 tracked threats
  • T1204.002 Malicious File — Executionobserved in 6 of 7 tracked threats
  • T1566.001 Spearphishing Attachment — Initial Accessobserved in 6 of 7 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 5 of 7 tracked threats
  • T1113 Screen Capture — Collectionobserved in 5 of 7 tracked threats
  • T1071.001 Web Protocols — Command and Controlobserved in 4 of 7 tracked threats
  • T1573.001 Symmetric Cryptography — Command and Controlobserved in 4 of 7 tracked threats
  • T1005 Data from Local System — Collectionobserved in 3 of 7 tracked threats
  • T1057 Process Discovery — Discoveryobserved in 3 of 7 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 3 of 7 tracked threats
  • T1059.007 Command and Scripting Interpreter — Executionobserved in 3 of 7 tracked threats
  • T1218 System Binary Proxy Execution — Stealth (formerly Defense Evasion)observed in 3 of 7 tracked threats
  • T1218.005 Mshta — Stealth (formerly Defense Evasion)observed in 3 of 7 tracked threats
  • T1546.015 Component Object Model Hijacking — Persistenceobserved in 3 of 7 tracked threats

Tracked threats

Related CVEs

5 CVEs referenced by tracked Zigzag Hail activity