[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frIOOzbiGtipCXxgodF_bkG4nIE6CpJd3h-n7OmG7FBA":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":36,"country":37,"suspected_sponsor":38,"target_industries":39,"target_countries":42,"incident_types":68,"references":70,"techniques":126,"technique_count":249,"created_at":250,"seoMetadata":251,"schemaOrg":255},"APT28","apt28",[9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"Pawn Storm","FANCY BEAR","Sednit","SNAKEMACKEREL","Tsar Team","TG-4127","STRONTIUM","Swallowtail","IRON TWILIGHT","Group 74","SIG40","Grizzly Steppe","G0007","ATK5","Fighting Ursa","ITG05","Blue Athena","TA422","T-APT-12","APT-C-20","UAC-0028","FROZENLAKE","Sofacy","Forest Blizzard","BlueDelta","Fancy Bear","GruesomeLarch","The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.","RU","Russian Federation",[40,41],"Government","Military",[43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67],"Georgia","France","Jordan","United States","Hungary","World Anti-Doping Agency","Armenia","Tajikistan","Japan","NATO","Ukraine","Belgium","Pakistan","Asia Pacific Economic Cooperation","International Association of Athletics Federations","Turkey","Mongolia","OSCE","United Kingdom","Germany","Poland","European Commission","Afghanistan","Kazakhstan","China",[69],"Espionage",[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125],"https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0007\u002F","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FFancy_Bear","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSofacy_Group","https:\u002F\u002Fwww.bbc.com\u002Fnews\u002Ftechnology-37590375","https:\u002F\u002Fwww.bbc.co.uk\u002Fnews\u002Ftechnology-45257081","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Fapt-28","https:\u002F\u002Fwww.apnews.com\u002F4d174e45ef5843a0ba82e804f080988f","https:\u002F\u002Fwww.voanews.com\u002Fa\u002Fiaaf-hack-fancy-bears\u002F3793874.html","https:\u002F\u002Fsecurelist.com\u002Fa-slice-of-2017-sofacy-activity\u002F83930\u002F","https:\u002F\u002Fwww.dw.com\u002Fen\u002Fhackers-lurking-parliamentarians-told\u002Fa-19564630","https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-sofacys-komplex-os-x-trojan\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fdear-joohn-sofacy-groups-global-campaign\u002F","https:\u002F\u002Fwww.fireeye.com\u002Fblog\u002Fthreat-research\u002F2015\u002F04\u002Fprobable_apt28_useo.html","https:\u002F\u002Fwww2.fireeye.com\u002Frs\u002F848-DID-242\u002Fimages\u002Fwp-mandiant-matryoshka-mining.pdf","https:\u002F\u002Fwww.eff.org\u002Fdeeplinks\u002F2015\u002F08\u002Fnew-spear-phishing-campaign-pretends-be-eff","https:\u002F\u002Faptnotes.malwareconfig.com\u002Fweb\u002Fviewer.html?file=..\u002FAPTnotes\u002F2014\u002Fapt28.pdf","https:\u002F\u002Fwww.accenture.com\u002Fus-en\u002Fblogs\u002Fblogs-snakemackerel-delivers-zekapab-malware","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Frussian-fancy-bears-hackers-release-apparent-ioc-emails\u002F","https:\u002F\u002Fsymantec-blogs.broadcom.com\u002Fblogs\u002Felection-security\u002Fapt28-espionage-military-government","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fbears-midst-intrusion-democratic-national-committee\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-sofacy-attacks-multiple-government-entities\u002F","https:\u002F\u002Fsecurelist.com\u002Fsofacy-apt-hits-high-profile-targets-with-updated-toolset\u002F72924\u002F","https:\u002F\u002Fwww.msn.com\u002Fen-nz\u002Fnews\u002Fworld\u002Frussian-hackers-accused-of-targeting-un-chemical-weapons-watchdog-mh17-files\u002Far-BBNV2ny","https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-new-sofacy-attacks-against-us-government-agency\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-let-ride-sofacy-groups-dealerschoice-attacks-continue\u002F","https:\u002F\u002Fwww.welivesecurity.com\u002F2018\u002F09\u002F27\u002Flojax-first-uefi-rootkit-found-wild-courtesy-sednit-group\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan\u002F","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fapt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild\u002F","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fpawn-storm-targets-mh17-investigation-team\u002F","https:\u002F\u002Fresearchcenter.paloaltonetworks.com\u002F2016\u002F06\u002Funit42-new-sofacy-attacks-against-us-government-agency\u002F","https:\u002F\u002Fwww.trendmicro.com\u002Fcloud-content\u002Fus\u002Fpdfs\u002Fsecurity-intelligence\u002Fwhite-papers\u002Fwp-operation-pawn-storm.pdf","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fnew-adobe-flash-zero-day-used-in-pawn-storm-campaign\u002F","https:\u002F\u002Fblogs.microsoft.com\u002Fon-the-issues\u002F2018\u002F08\u002F20\u002Fwe-are-taking-new-steps-against-broadening-threats-to-democracy\u002F","https:\u002F\u002Fwww.lse.co.uk\u002FAllNews.asp?code=kwdwehme&headline=Russian_Hackers_Suspected_In_Cyberattack_On_German_Parliament","https:\u002F\u002Fwww.volkskrant.nl\u002Fcultuur-media\u002Frussen-faalden-bij-hackpogingen-ambtenaren-op-nederlandse-ministeries~b77ff391\u002F","https:\u002F\u002Fwww.ibtimes.co.uk\u002Frussian-hackers-fancy-bear-likely-breached-olympic-drug-testing-agency-dnc-experts-say-1577508","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections\u002F","https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected","https:\u002F\u002Fwww.accenture.com\u002Ft20181129T203820Z__w__\u002Fus-en\u002F_acnmedia\u002FPDF-90\u002FAccenture-snakemackerel-delivers-zekapab-malware.pdf","https:\u002F\u002Fwww.reuters.com\u002Farticle\u002Fus-sweden-doping\u002Fswedish-sports-body-says-anti-doping-unit-hit-by-hacking-attack-idUSKCN1IG2GN","https:\u002F\u002Fresearchcenter.paloaltonetworks.com\u002F2016\u002F10\u002Funit42-dealerschoice-sofacys-flash-player-exploit-platform\u002F","https:\u002F\u002Fnetzpolitik.org\u002F2015\u002Fdigital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag\u002F","https:\u002F\u002Fwww.washingtonpost.com\u002Ftechnology\u002F2019\u002F02\u002F20\u002Fmicrosoft-says-it-has-found-another-russian-operation-targeting-prominent-think-tanks\u002F?utm_term=.870ff11468ae","https:\u002F\u002Fwww.handelsblatt.com\u002Ftoday\u002Fpolitics\u002Felection-risks-russia-linked-hackers-target-german-political-foundations\u002F23569188.html?ticket=ST-2696734-GRHgtQukDIEXeSOwksXO-ap1","https:\u002F\u002Fwww.accenture.com\u002Ft20190213T141124Z__w__\u002Fus-en\u002F_acnmedia\u002FPDF-94\u002FAccenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf","https:\u002F\u002Fmarcoramilli.com\u002F2019\u002F12\u002F05\u002Fapt28-attacks-evolution\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fsecurity\u002Fblog\u002F2020\u002F09\u002F10\u002Fstrontium-detecting-new-patters-credential-harvesting\u002F","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-hackers-use-fake-nato-training-docs-to-breach-govt-networks\u002F","https:\u002F\u002Fquointelligence.eu\u002F2020\u002F09\u002Fapt28-zebrocy-malware-campaign-nato-theme\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fatoms\u002Ffighting-ursa\u002F","https:\u002F\u002Fblog.google\u002Fthreat-analysis-group\u002Fcontinued-cyber-activity-in-eastern-europe-observed-by-tag","https:\u002F\u002Fblog.google\u002Fthreat-analysis-group\u002Ffog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape\u002F","https:\u002F\u002Fwww.bsi.bund.de\u002FDE\u002FThemen\u002FUnternehmen-und-Organisationen\u002FCyber-Sicherheitslage\u002FAnalysen-und-Prognosen\u002FThreat-Intelligence\u002FAktive_APT-Gruppen\u002Faktive-apt-gruppen_node.html","https:\u002F\u002Fbluepurple.binaryfirefly.com\u002Fp\u002Fbluepurple-pulse-week-ending-june-64e","https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2024\u002F11\u002F22\u002Fthe-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access\u002F",[127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248],"T1021","T1134","T1134.001","T1098","T1098.002","T1583","T1583.001","T1583.003","T1583.006","T1595","T1595.002","T1557","T1557.004","T1071","T1071.001","T1071.003","T1560","T1560.001","T1119","T1547","T1547.001","T1037","T1037.001","T1110","T1110.001","T1110.003","T1059","T1059.001","T1059.003","T1092","T1586","T1586.002","T1584","T1584.008","T1213","T1213.002","T1005","T1039","T1025","T1001","T1001.001","T1074","T1074.001","T1074.002","T1030","T1140","T1189","T1114","T1114.002","T1573","T1573.001","T1546","T1546.015","T1048","T1048.002","T1567","T1190","T1203","T1211","T1068","T1210","T1133","T1083","T1589","T1589.001","T1564","T1564.001","T1564.003","T1070","T1070.004","T1070.006","T1105","T1056","T1056.001","T1559","T1559.002","T1036","T1036.005","T1498","T1040","T1027","T1027.013","T1588","T1588.002","T1137","T1137.002","T1003","T1003.001","T1003.003","T1120","T1566","T1566.001","T1598","T1598.003","T1542","T1542.003","T1057","T1090","T1090.002","T1090.003","T1021.002","T1091","T1014","T1113","T1505","T1505.003","T1528","T1218","T1218.011","T1221","T1199","T1550","T1550.001","T1550.002","T1204","T1204.001","T1204.002","T1078","T1078.004","T1102","T1102.002","T1685.005",122,"2023-08-09T17:25:09.409843+00:00",{"title":252,"metaDescription":253,"keywords":254},"APT28 Threat Actor Profile | Precursor Intelligence","The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. ...","APT28, Pawn Storm, FANCY BEAR, Sednit, SNAKEMACKEREL, Tsar Team, TG-4127, STRONTIUM, Swallowtail, IRON TWILIGHT, Group 74, SIG40, Grizzly Steppe, G0007, ATK5, Fighting Ursa, ITG05, Blue Athena, TA422, T-APT-12, APT-C-20, UAC-0028, FROZENLAKE, Sofacy, Forest Blizzard, BlueDelta, Fancy Bear, GruesomeLarch, threat actor, APT, cyber threat, threat intelligence, Government, Military, Russian Federation, RU",{"@context":256,"@type":257,"name":6,"alternateName":258,"description":36,"url":259,"mainEntityOfPage":260,"location":262},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fapt28",{"@type":261,"@id":259},"WebPage",{"@type":263,"name":37},"Country"]