H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

NativeZone

[NativeZone](https://attack.mitre.org/software/S0637) is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/software/S0154) loaders used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[NativeZone](https://attack.mitre.org/software/S0637) is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/software/S0154) loaders used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)

Labels

malware
7 recorded

Relationships

uses
from APT29
Group
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Execution Guardrails
Technique
uses
to Malicious File
Technique
uses
to Masquerading
Technique
uses
to Rundll32
Technique
uses
to System Checks
Technique
3 external

References

mitre-attack
S0637
open
MSTIC Nobelium Toolset May 2021
https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
open
SentinelOne NobleBaron June 2021
https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance