Npcore

NPCore, Inc. is a South Korean information security company that develops detection and response solutions for new and variant malware, marketed mainly under the ZombieZERO brand. Its portfolio spans network, email and file APT (advanced persistent threat) appliances in the ZombieZERO Inspector V4.0 series, an integrated management console, ZombieZERO EDR for endpoints, ZombieZERO SECaaS for cloud-delivered security, ZombieZERO CTI threat intelligence, ZombieZERO XDR, npFirewall and RansomZERO anti-ransomware. The company also runs malware security consulting and a security education business.

The network APT product, ZombieZERO Inspector N, extracts URLs and files from bidirectional network traffic across protocols such as HTTP, HTTPS, SMTP, POP and IMAP and applies multi-layer analysis: blacklist/whitelist patterns, an antivirus engine, YARA-rule static analysis, sandbox-based dynamic behavior analysis and reputation lookups, including a dedicated engine for non-PE files such as JavaScript, SWF and documents (HWP, MS Office, PDF, images, media). It blocks C&C communications and malicious URLs, redirects users to a landing page, supplies PCAP evidence, MITRE ATT&CK classification and syslog forwarding to SIEM/ESM systems. ZombieZERO EDR is an agent-based endpoint product that uses behavior-based rather than signature-based detection to identify and neutralize ransomware and unknown malware in real time, and integrates with the XDR layer.

ZombieZERO XDR consolidates endpoint, network and security-device telemetry in one detection framework and combines active data collection with automated threat determination (described by the company as AI-TIP), aiming to let organizations automatically classify attackers, attack types and countermeasures without dedicated analysts. Outputs include incident information, malware similarity, threat site prediction, attack technique and attack group attribution derived from threat hunting. NPCore positions the platform for institutions and enterprises operating multiple security devices or security operations centers, and also describes a threat intelligence data platform offered via portal, including free access for verified white-hat researchers, non-profit research institutes and educational institutions.

Business model

NPCore licenses and sells security products — network/email/file APT appliances, endpoint EDR agents, XDR and firewall software — to organizations, complemented by cloud-delivered security-as-a-service (ZombieZERO SECaaS), threat intelligence (ZombieZERO CTI) offered as a service or portal, malware security consulting and a security education business. A dedicated malware analysis team provides manual analysis reports and incident response support alongside the products.

Product sales and service delivery: security appliance and software solutions sold to institutions and enterprises, cloud-based SECaaS, threat intelligence services (including a portal offered to security control providers and enterprises, with free access tiers for non-profit users), consulting and security training.

Traction

The company states that its ZombieZERO two-level APT defense has been supplied to governments, financial institutions, universities and enterprises. Product certifications include GS Certification, international CC EAL2 and a Korean National Intelligence Service security function certificate for ZombieZERO XDR (May 2026), and RansomZERO won an IR52 Jang Young Shil Award (April 2026).

Latest developments

In 2026 the company obtained a National Intelligence Service security function certificate for its XDR security solution (May 2026), received an IR52 Jang Young Shil Award for the RansomZERO anti-ransomware product (April 2026), ran a subway booth promotional campaign (March 2026), and announced participation in Vietnam Security Summit 2026 (May 2026) to present next-generation XDR and ransomware response technology. A shareholder record date notice was posted for May 2026.