# APT28: threat group profile

> APT28 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 69 attack techniques, and to attacks on government and military organisations, with 25 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/apt28
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > APT28

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 69 (plus 54 sub-techniques) |
| Countries and victims named | 25 |
| Thought to operate from | Russia |
| Suspected backing | Russia |
| Motive | Espionage |
| Other names | 27 |
| Public reports | 55 |

## Who is APT28?

APT28 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 69 attack techniques, and to attacks on government and military organisations, with 25 countries and victims named.

### Also known as

Pawn Storm, FANCY BEAR, Sednit, SNAKEMACKEREL, Tsar Team, TG-4127, STRONTIUM, Swallowtail, IRON TWILIGHT, Group 74, SIG40, Grizzly Steppe, G0007, ATK5, Fighting Ursa, ITG05, Blue Athena, TA422, T-APT-12, APT-C-20, UAC-0028, FROZENLAKE, Sofacy, Forest Blizzard, BlueDelta, Fancy Bear, GruesomeLarch

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

## How does APT28 attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 69 linked to APT28. Some techniques belong to more than one stage. Public reporting also lists 54 more specific variations of them, called sub-techniques.

### 1. Research (3)

- T1589: Gather Victim Identity Information
- T1595: Active Scanning
- T1598: Phishing for Information

### 2. Preparation (4)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1586: Compromise Accounts
- T1588: Obtain Capabilities

### 3. Getting in (7)

- T1078: Valid Accounts
- T1091: Replication Through Removable Media
- T1133: External Remote Services
- T1189: Drive-by Compromise
- T1190: Exploit Public-Facing Application
- T1199: Trusted Relationship
- T1566: Phishing

### 4. Running code (4)

- T1059: Command and Scripting Interpreter
- T1203: Exploitation for Client Execution
- T1204: User Execution
- T1559: Inter-Process Communication

### 5. Staying in (9)

- T1037: Boot or Logon Initialization Scripts
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1133: External Remote Services
- T1137: Office Application Startup
- T1505: Server Software Component
- T1542: Pre-OS Boot
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (7)

- T1037: Boot or Logon Initialization Scripts
- T1068: Exploitation for Privilege Escalation
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1134: Access Token Manipulation
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (12)

- T1014: Rootkit
- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1070: Indicator Removal
- T1078: Valid Accounts
- T1134: Access Token Manipulation
- T1140: Deobfuscate/Decode Files or Information
- T1211: Exploitation for Stealth
- T1218: System Binary Proxy Execution
- T1221: Template Injection
- T1542: Pre-OS Boot
- T1564: Hide Artifacts

### 8. Disabling defences (1)

- T1685: Disable or Modify Tools

### 9. Stealing passwords (6)

- T1003: OS Credential Dumping
- T1040: Network Sniffing
- T1056: Input Capture
- T1110: Brute Force
- T1528: Steal Application Access Token
- T1557: Adversary-in-the-Middle

### 10. Looking around (4)

- T1040: Network Sniffing
- T1057: Process Discovery
- T1083: File and Directory Discovery
- T1120: Peripheral Device Discovery

### 11. Spreading (4)

- T1021: Remote Services
- T1091: Replication Through Removable Media
- T1210: Exploitation of Remote Services
- T1550: Use Alternate Authentication Material

### 12. Gathering data (11)

- T1005: Data from Local System
- T1025: Data from Removable Media
- T1039: Data from Network Shared Drive
- T1056: Input Capture
- T1074: Data Staged
- T1113: Screen Capture
- T1114: Email Collection
- T1119: Automated Collection
- T1213: Data from Information Repositories
- T1557: Adversary-in-the-Middle
- T1560: Archive Collected Data

### 13. Keeping contact (7)

- T1001: Data Obfuscation
- T1071: Application Layer Protocol
- T1090: Proxy
- T1092: Communication Through Removable Media
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1573: Encrypted Channel

### 14. Taking data out (3)

- T1030: Data Transfer Size Limits
- T1048: Exfiltration Over Alternative Protocol
- T1567: Exfiltration Over Web Service

### 15. Causing damage (1)

- T1498: Network Denial of Service

## Who does APT28 go after?

**Sectors:** Government, Military

**Countries and victims named:** Georgia, France, Jordan, United States, Hungary, World Anti-Doping Agency, Armenia, Tajikistan, Japan, NATO, Ukraine, Belgium, Pakistan, Asia Pacific Economic Cooperation, International Association of Athletics Federations, Turkey, Mongolia, OSCE, United Kingdom, Germany, Poland, European Commission, Afghanistan, Kazakhstan, China

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about APT28

- https://attack.mitre.org/groups/G0007/
- https://en.wikipedia.org/wiki/Fancy_Bear
- https://en.wikipedia.org/wiki/Sofacy_Group
- https://www.bbc.com/news/technology-37590375
- https://www.bbc.co.uk/news/technology-45257081
- https://www.cfr.org/interactive/cyber-operations/apt-28
- https://www.apnews.com/4d174e45ef5843a0ba82e804f080988f
- https://www.voanews.com/a/iaaf-hack-fancy-bears/3793874.html
- https://securelist.com/a-slice-of-2017-sofacy-activity/83930/
- https://www.dw.com/en/hackers-lurking-parliamentarians-told/a-19564630
- https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/
- https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/
- https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
- https://www2.fireeye.com/rs/848-DID-242/images/wp-mandiant-matryoshka-mining.pdf
- https://www.eff.org/deeplinks/2015/08/new-spear-phishing-campaign-pretends-be-eff
- https://aptnotes.malwareconfig.com/web/viewer.html?file=../APTnotes/2014/apt28.pdf
- https://www.accenture.com/us-en/blogs/blogs-snakemackerel-delivers-zekapab-malware
- https://www.wired.com/story/russian-fancy-bears-hackers-release-apparent-ioc-emails/
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
- https://unit42.paloaltonetworks.com/unit42-sofacy-attacks-multiple-government-entities/
- https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
- https://www.msn.com/en-nz/news/world/russian-hackers-accused-of-targeting-un-chemical-weapons-watchdog-mh17-files/ar-BBNV2ny
- https://unit42.paloaltonetworks.com/unit42-new-sofacy-attacks-against-us-government-agency/
- https://unit42.paloaltonetworks.com/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
- https://www.bleepingcomputer.com/news/security/apt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild/
- https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-targets-mh17-investigation-team/
- https://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/
- https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
- https://blogs.microsoft.com/on-the-issues/2018/08/20/we-are-taking-new-steps-against-broadening-threats-to-democracy/
- https://www.lse.co.uk/AllNews.asp?code=kwdwehme&headline=Russian_Hackers_Suspected_In_Cyberattack_On_German_Parliament
- https://www.volkskrant.nl/cultuur-media/russen-faalden-bij-hackpogingen-ambtenaren-op-nederlandse-ministeries~b77ff391/
- https://www.ibtimes.co.uk/russian-hackers-fancy-bear-likely-breached-olympic-drug-testing-agency-dnc-experts-say-1577508
- https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/
- https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected
- https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf
- https://www.reuters.com/article/us-sweden-doping/swedish-sports-body-says-anti-doping-unit-hit-by-hacking-attack-idUSKCN1IG2GN
- https://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/
- https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
- https://www.washingtonpost.com/technology/2019/02/20/microsoft-says-it-has-found-another-russian-operation-targeting-prominent-think-tanks/?utm_term=.870ff11468ae
- https://www.handelsblatt.com/today/politics/election-risks-russia-linked-hackers-target-german-political-foundations/23569188.html?ticket=ST-2696734-GRHgtQukDIEXeSOwksXO-ap1
- https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf
- https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/
- https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/
- https://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-nato-training-docs-to-breach-govt-networks/
- https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/
- https://unit42.paloaltonetworks.com/atoms/fighting-ursa/
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
- https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://bluepurple.binaryfirefly.com/p/bluepurple-pulse-week-ending-june-64e
- https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/

## Frequently asked questions

### Who is APT28?

APT28 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 69 attack techniques, and to attacks on government and military organisations, with 25 countries and victims named.

### Where is APT28 thought to be based?

Public reporting places APT28 as operating from Russia, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does APT28 target?

In public reporting, sectors named include government and military, and 25 countries and victims are named, including Georgia, France, Jordan and United States.

### How does APT28 attack?

Public reporting links APT28 to 69 attack techniques. Most of them are about hiding, gathering data and staying in.

### How do I know if APT28 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact