APT28 — Threat Actors — SecurityStudies.info

News fetched Nov 13, 00:01 UTC

Cyber threats / Threat actors

Profile

Also known as: APT-C-20, ATK5, Blue Athena, BlueDelta, FANCY BEAR, Fighting Ursa, Forest Blizzard, FROZENLAKE, G0007, Grizzly Steppe, Group 74, GruesomeLarch, IRON TWILIGHT, ITG05, LAKE RELIC, Pawn Storm, Sednit, SIG40, SNAKEMACKEREL, Sofacy, STRONTIUM, Swallowtail, T-APT-12, TA422, TG-4127, Threat Group-4127, Tsar Team, UAC-0001, UAC-0028

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

Related profiles: APT29, White Bear

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 93

Reconnaissance

T1589.001Credentials T1591Gather Victim Org Information T1595.002Vulnerability Scanning T1596Search Open Technical Databases T1598Phishing for Information T1598.003Spearphishing Link

Resource Development

T1583.001Domains T1583.003Virtual Private Server T1583.006Web Services T1584.008Network Devices T1586.002Email Accounts T1588.002Tool T1588.007Artificial Intelligence

Initial Access

T1078Valid Accounts T1078.004Cloud Accounts T1091Replication Through Removable Media T1133External Remote Services T1189Drive-by Compromise T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment T1669Wi-Fi Networks

Execution

T1059.001PowerShell T1059.003Windows Command Shell T1203Exploitation for Client Execution T1204.001Malicious Link T1204.002Malicious File T1559.002Dynamic Data Exchange

Persistence

T1037.001Logon Script (Windows)T1098.002Additional Email Delegate Permissions T1137.002Office Test T1505.003Web Shell T1542.003Bootkit T1546.015Component Object Model Hijacking T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1068Exploitation for Privilege Escalation T1134.001Token Impersonation/Theft

Stealth

T1014Rootkit T1027.013Encrypted/Encoded File T1036Masquerading T1036.005Match Legitimate Resource Name or Location T1070.004File Deletion T1070.006Timestomp T1140Deobfuscate/Decode Files or Information T1211Exploitation for Stealth T1218.011Rundll32 T1221Template Injection T1564.001Hidden Files and Directories T1564.003Hidden Window T1684.001Impersonation

Defense Impairment

T1685.005Clear Windows Event Logs

Credential Access

T1003OS Credential Dumping T1003.001LSASS Memory T1003.003NTDS T1040Network Sniffing T1056.001Keylogging T1110Brute Force T1110.001Password Guessing T1110.003Password Spraying T1528Steal Application Access Token T1557.004Evil Twin

Discovery

T1057Process Discovery T1083File and Directory Discovery T1120Peripheral Device Discovery

Lateral Movement

T1021.002SMB/Windows Admin Shares T1210Exploitation of Remote Services T1550.001Application Access Token T1550.002Pass the Hash

Collection

T1005Data from Local System T1025Data from Removable Media T1039Data from Network Shared Drive T1074.001Local Data Staging T1074.002Remote Data Staging T1113Screen Capture T1114.002Remote Email Collection T1119Automated Collection T1213Data from Information Repositories T1213.002Sharepoint T1560Archive Collected Data T1560.001Archive via Utility

Command and Control

T1001.001Junk Data T1071.001Web Protocols T1071.003Mail Protocols T1090.002External Proxy T1090.003Multi-hop Proxy T1092Communication Through Removable Media T1102.002Bidirectional Communication T1105Ingress Tool Transfer T1573.001Symmetric Cryptography

Exfiltration

T1030Data Transfer Size Limits T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1567Exfiltration Over Web Service

Impact

T1498Network Denial of Service

Incidents attributed

No incident in the register is attributed to this actor.

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

Targets

Elsewhere: Afghanistan, Armenia, Belgium, Germany, France, United Kingdom, Georgia, Hungary, Jordan, Kazakhstan, Pakistan, Poland, Tajikistan, Türkiye, Ukraine, United States

Sectors: Government, Government, Administration, Military, Security Service

Relevance to the EU

EU relevance: High

EU cyber sanctions since 2020 (OPCW and Bundestag intrusions)

18 EU cooperation projects in the Asia-Pacific countries this actor targets:

Trade & Investment

6

Research & Innovation

3

Development Cooperation

2

Climate & Environment

2

Peace & Security

1

Infrastructure & Transport

1

Governance & Rule of Law

1

Energy & Green Transition

1

Threats to the EU →

References

Sources: MISP, MITRE