APT28
Also known as: Fancy Bear, Sofacy, Pawn Storm, Sednit, STRONTIUM, Forest Blizzard, Tsar Team, Threat Group-4127, ITG05, UAC-0001, GruesomeLarch, BlueDelta, Blue Athena, TA422, Fighting Ursa, SNAKEMACKEREL, Swallowtail, SIG40, Storm-2754
MITRE ATT&CK Techniques
(56)Initial Access
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
Other
T1053.005
T1071.001
T1560.001
T1556.001
T1583.001
T1588.002
T1574.001
T1218.011
T1102
T1586
T1598
T1134
T1542
T1567.002
T1557
T1119
T1020
T1113
T1091
T1210
T1498
T1556
T1583.006
T1588.001
T1608.001
T1562.001
T1070.004
T1048.003
T1087.002
T1135
T1552.001
T1110.001
T1564.001
T1600
T1221
T1204.002
T1546.015
T1553.005
T1557.001
Defense Evasion
Exfiltration
Privilege Escalation
Command and Control
Discovery
Tools & Malware
(23)X-Agent
Primary modular backdoor for Windows, Linux, iOS, and Android. Provides remote access, keylogging, file exfiltration, and screenshot capture. Central to APT28 operations since 2007.
Zebrocy
Multi-language dropper/backdoor written in Delphi, AutoIT, C++, C#, Go, and VB.NET. Used as first-stage reconnaissance and downloader in spear-phishing campaigns.
Seduploader
Lightweight first-stage reconnaissance implant delivered via spear-phishing. Profiles the victim's system before deploying X-Agent or other second-stage payloads.
CredoMap
Credential stealer that harvests saved passwords and cookies from web browsers. Deployed after initial access to gather authentication material for lateral movement.
OCEANMAP
Backdoor using IMAP email protocol for C2 communication, making traffic blend with normal email activity. Used in campaigns targeting Ukrainian entities.
Cobalt Strike
Commercial adversary simulation framework used for post-exploitation. APT28 deploys Cobalt Strike beacons for lateral movement, privilege escalation, and persistent C2.
Mimikatz
Used extensively for credential dumping — extracting plaintext passwords, NTLM hashes, and Kerberos tickets from Windows memory for lateral movement.
Responder
LLMNR/NBT-NS/mDNS poisoner used to capture NTLMv2 hashes on local networks. APT28 deploys this for credential harvesting during lateral movement.
Impacket
Python library for network protocol manipulation. APT28 uses wmiexec, smbexec, and secretsdump modules for remote execution and credential extraction.
PowerShell
Used for fileless execution of payloads, reconnaissance scripts, and downloading additional tools. Frequently used with encoded commands to evade detection.
certutil
Windows certificate utility abused to download payloads from C2 servers and decode Base64-encoded malware, bypassing application whitelisting.
rundll32
Used to execute malicious DLLs and proxy execution of payloads, evading process-based detection rules.
Nmap
Network scanner used for reconnaissance — mapping target networks, identifying open ports, and discovering services for exploitation.
CHOPSTICK
Second-generation modular implant (also known as X-Agent variant) with plugins for keylogging, file transfer, and remote shell operations.
GoDownloader
Golang-based downloader used as an intermediary to fetch and execute Zebrocy or X-Agent. Often delivered via weaponized documents.
VPNFilter
Multi-stage modular malware that infected 500,000+ SOHO routers and NAS devices worldwide. Used for traffic interception, credential stealing, and destructive capabilities.
Sofacy
First-stage backdoor typically delivered via spearphishing
GAMEFISH
Backdoor also known as Sednit and Seduploader
LoJax
UEFI rootkit used for persistence
DealersChoice
Flash Player exploitation framework used in targeted attacks
Cannon
Trojan using email-based C2 communications
KopiLuwak
JavaScript-based reconnaissance malware
JHUHUGIT
Malware used in credential harvesting campaigns
Indicators of Compromise
(15)| Type | Value |
|---|---|
| domain | login-microsoftonline[.]com |
| domain | mail-loqin[.]com |
| domain | accounts-google[.]com |
| ip | 185[.]80[.]53[.]107 |
| ip | 77[.]83[.]247[.]72 |
| hash | d41d8cd98f00b204e9800998ecf8427e |
| domain | wellnessmedcare[.]org |
| domain | wellnesscaremed[.]com |
| domain | freefoodaid[.]com |
| domain | longsauce[.]com |
| domain | packinstall[.]kozow[.]com |
| domain | filen[.]io |
| domain | webhook[.]site |
| url | filen[.]io |
| url | webhook[.]site |
Infrastructure
(12)| Domain / Host | Status |
|---|---|
login-microsoftonline[.]comCredential harvesting domain mimicking Microsoft login | whois_changed |
mail-loqin[.]comPhishing domain used in credential harvesting campaigns | offline |
accounts-google[.]comGoogle-themed credential harvesting | active |
185[.]80[.]53[.]107C2 server used in European government targeting (2023) | active |
77[.]83[.]247[.]72Infrastructure linked to Zebrocy operations | offline |
wellnessmedcare[.]org | offline |
wellnesscaremed[.]com | offline |
freefoodaid[.]com | active |
longsauce[.]com | active |
packinstall[.]kozow[.]com | active |
filen[.]io | whois_changed |
webhook[.]site | active |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
References
(23)MITRE ATT&CK - APT28
https://attack.mitre.org/groups/G0007/
Microsoft - Forest Blizzard (STRONTIUM)
https://www.microsoft.com/en-us/security/blog/threat-intelligence/forest-blizzard-strontium/
Mandiant - APT28: A Window into Russia's Cyber Espionage Operations
https://www.mandiant.com/resources/apt28-a-window-into-russias-cyber-espionage-operations
APT28's Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure - Trellix
https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/
Operation Neusploit: APT28 Uses CVE-2026-21509 - Zscaler ThreatLabz
https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit
APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military - The Hacker News
https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html
Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure - LAB52
https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks - Volexity
https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack/
Russian GRU Targeting Western Logistics Entities and Technology Companies - CISA AA25-141A
https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF
Russia's Unit 26165 Resumes High-End Malware Campaigns - Bank Info Security
https://www.bankinfosecurity.com/russias-unit-26165-resumes-high-end-malware-campaigns-a-30947
APT28's New Arsenal: LAMEHUG, the First AI-Powered Malware - Logpoint
https://logpoint.com/en/blog/apt28s-new-arsenal-lamehug-the-first-ai-powered-malware
APT28 Credential Phishing Campaign Targets UKR.net Users - Rescana
https://www.rescana.com/post/apt28-credential-phishing-campaign-targets-ukr-net-users-technical-analysis-and-threat-intelligence
Fancy Bear 'Nearest Neighbor' Attack Uses Nearby Wi-Fi Network - Dark Reading
https://www.darkreading.com/cyberattacks-data-breaches/fancy-bear-nearest-neighbor-attack-wi-fi
APT28: A Window Into Russia's Cyber Espionage Operations
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
Sofacy Group's Parallel Attacks
https://www.paloaltonetworks.com/resources/research/unit42-sofacy-groups-parallel-attacks
LoJax: First UEFI rootkit found in the wild
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies - The Hacker News
https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html
Pawn Storm Campaign Deploys PRISMEX - Trend Micro
https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html
Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign - The Hacker News
https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html
FrostArmada campaign disrupted: APT28 router hijacking operation halted - SC Media
https://www.scworld.com/brief/frostarmada-campaign-disrupted-apt28-router-hijacking-operation-halted
APT28 Targeted European Entities Using Webhook-Based Macro Malware - The Hacker News
https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html
Russia's APT28 behind latest wave of router, DNS attacks - The Register
https://www.theregister.com/2026/04/07/russia_fancy_bear_ncsc_router_attack/
APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) Threat Actor Profile - TIR
https://www.threatintelreport.com/2026/02/20/threat_actor_profiles/threat-actor-profile-apt28/