# Zigzag Hail

> As of 2026-10-28, Zigzag Hail is a threat actor tracked by Threadlinqs Intelligence across 7 threats spanning apt, malware. ATT&CK coverage spans 64 techniques across 12 tactics in 7 of 7 tracked threats. Most-observed techniques: T1082 (System Information Discovery), T1140 (Deobfuscate/Decode Files or Information), T1204.002 (Malicious File).

- **Tracked threats:** 7
- **Categories:** APT, MALWARE
- **As of:** 2026-10-28

## ATT&CK techniques observed

64 techniques observed across 7 of 7 tracked threats. Tactics: Stealth (formerly Defense Evasion) (13), Command and Control (10), Execution (9), Resource Development (9), Persistence (6), Discovery (4).

- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 7 of 7 tracked threats
- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 6 of 7 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 6 of 7 tracked threats
- [T1566.001](https://intel.threadlinqs.com/technique/T1566.001) Spearphishing Attachment — Initial Access — observed in 6 of 7 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 5 of 7 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 5 of 7 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 4 of 7 tracked threats
- [T1573.001](https://intel.threadlinqs.com/technique/T1573.001) Symmetric Cryptography — Command and Control — observed in 4 of 7 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 3 of 7 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 3 of 7 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 3 of 7 tracked threats
- [T1059.007](https://intel.threadlinqs.com/technique/T1059.007) Command and Scripting Interpreter — Execution — observed in 3 of 7 tracked threats
- [T1218](https://intel.threadlinqs.com/technique/T1218) System Binary Proxy Execution — Stealth (formerly Defense Evasion) — observed in 3 of 7 tracked threats
- [T1218.005](https://intel.threadlinqs.com/technique/T1218.005) Mshta — Stealth (formerly Defense Evasion) — observed in 3 of 7 tracked threats
- [T1546.015](https://intel.threadlinqs.com/technique/T1546.015) Component Object Model Hijacking — Persistence — observed in 3 of 7 tracked threats

## Tracked threats

- [APT-C-60 Spear-Phishing Campaign Against Japanese Organizations Delivering SpyGlace via Proton Drive, LNK/mshta and git.exe](https://intel.threadlinqs.com/threat/TL-2026-4638) — HIGH
- [NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation](https://intel.threadlinqs.com/threat/TL-2026-4041) — HIGH
- [APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia](https://intel.threadlinqs.com/threat/TL-2026-3843) — HIGH
- [APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer Services](https://intel.threadlinqs.com/threat/TL-2026-2371) — HIGH
- [APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware](https://intel.threadlinqs.com/threat/TL-2026-2134) — HIGH
- [SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan](https://intel.threadlinqs.com/threat/TL-2026-1284) — HIGH
- [APT-C-60 2026 Campaign: SpyGlace Backdoor Delivered via LNK Files and Abused Legitimate Services](https://intel.threadlinqs.com/threat/TL-2026-1249) — HIGH

## Related CVEs

5 CVEs referenced by tracked Zigzag Hail activity.

- [CVE-2026-68820](https://intel.threadlinqs.com/cve/CVE-2026-68820)
- [CVE-2026-42897](https://intel.threadlinqs.com/cve/CVE-2026-42897)
- [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113)
- [CVE-2024-7263](https://intel.threadlinqs.com/cve/CVE-2024-7263)
- [CVE-2024-7262](https://intel.threadlinqs.com/cve/CVE-2024-7262)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Zigzag%20Hail