Threat intelligence / Group

APT28

[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034).

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

123 recorded

Relationships

attributed-to

from APT28 Nearest Neighbor Campaign

Campaign

uses

to Additional Email Delegate Permissions

Technique

uses

to ADVSTORESHELL

Malware

uses

to Application Access Token

Technique

uses

to Archive Collected Data

Technique

uses

to Archive via Utility

Technique

uses

to Artificial Intelligence

Technique

uses

to Automated Collection

Technique

uses

to Bidirectional Communication

Technique

uses

to Bootkit

Technique

uses

to Brute Force

Technique

uses

to Cannon

Malware

uses

to certutil

Tool

uses

to CHOPSTICK

Malware

uses

to cipher.exe

Tool

uses

to Clear Windows Event Logs

Technique

uses

to Cloud Accounts

Technique

uses

to Communication Through Removable Media

Technique

uses

to Component Object Model Hijacking

Technique

uses

to CORESHELL

Malware

uses

to Credentials

Technique

uses

to Data from Information Repositories

Technique

uses

to Data from Local System

Technique

uses

to Data from Network Shared Drive

Technique

uses

to Data from Removable Media

Technique

uses

to Data Transfer Size Limits

Technique

uses

to DealersChoice

Malware

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domains

Technique

uses

to Downdelph

Malware

uses

to Drive-by Compromise

Technique

uses

to Drovorub

Malware

uses

to Dynamic Data Exchange

Technique

uses

to Email Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Evil Twin

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploitation for Stealth

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Proxy

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Forfiles

Tool

uses

to Fysbis

Malware

uses

to Gather Victim Org Information

Technique

uses

to Hidden Files and Directories

Technique

uses

to Hidden Window

Technique

uses

to HIDEDRV

Malware

uses

to Impersonation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to JHUHUGIT

Malware

uses

to Junk Data

Technique

uses

to Keylogging

Technique

uses

to Koadic

Tool

uses

to Komplex

Malware

uses

to LAMEHUG

Malware

uses

to Local Data Staging

Technique

uses

to Logon Script (Windows)

Technique

uses

to LoJax

Malware

uses

to LSASS Memory

Technique

uses

to Mail Protocols

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Multi-hop Proxy

Technique

uses

to Net

Tool

uses

to Network Denial of Service

Technique

uses

to Network Devices

Technique

uses

to Network Sniffing

Technique

uses

to NTDS

Technique

uses

to Office Test

Technique

uses

to OLDBAIT

Malware

uses

to OS Credential Dumping

Technique

uses

to Pass the Hash

Technique

uses

to Password Guessing

Technique

uses

to Password Spraying

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Phishing for Information

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to reGeorg

Malware

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Data Staging

Technique

uses

to Remote Email Collection

Technique

uses

to Replication Through Removable Media

Technique

uses

to Responder

Tool

uses

to Rootkit

Technique

uses

to Rundll32

Technique

uses

to Screen Capture

Technique

uses

to Search Open Technical Databases

Technique

uses

to Sharepoint

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Application Access Token

Technique

uses

to Symmetric Cryptography

Technique

uses

to Template Injection

Technique

uses

to Timestomp

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Tool

Technique

uses

to Tor

Tool

uses

to Trusted Relationship

Technique

uses

to USBStealer

Malware

uses

to Valid Accounts

Technique

uses

to Virtual Private Server

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Protocols

Technique

uses

to Web Services

Technique

uses

to Web Shell

Technique

uses

to Wevtutil

Tool

uses

to Wi-Fi Networks

Technique

uses

to Windows Command Shell

Technique

uses

to Winexe

Tool

uses

to XAgentOSX

Malware

uses

to XTunnel

Malware

uses

to Zebrocy

Malware

44 external

References

mitre-attack

G0007

open

SNAKEMACKEREL

—

Fancy Bear

—

Tsar Team

—

APT28

—

STRONTIUM

—

FROZENLAKE

—

Forest Blizzard

—

GruesomeLarch

—

IRON TWILIGHT

—

Threat Group-4127

—

TG-4127

—

Pawn Storm

—

Swallowtail

—

Group 74

—

Accenture SNAKEMACKEREL Nov 2018

https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50

open

Crowdstrike DNC June 2016

https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

open

Leonard TAG 2023

https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/

open

US District Court Indictment GRU Oct 2018

https://www.justice.gov/opa/page/file/1098481/download

open

GRIZZLY STEPPE JAR

https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf

open

ESET Zebrocy May 2019

https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/

open

ESET Sednit Part 3

http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf

open

Sofacy DealersChoice

https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/

open

FireEye APT28 January 2017

https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf

open

FireEye APT28

https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

open

Ars Technica GRU indictment Jul 2018

https://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/

open

TrendMicro Pawn Storm Dec 2020

https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html

open

Securelist Sofacy Feb 2018

https://securelist.com/a-slice-of-2017-sofacy-activity/83930/

open

Kaspersky Sofacy

https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/

open

Nearest Neighbor Volexity

https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/

open

Palo Alto Sofacy 06-2018

https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/

open

Talos Seduploader Oct 2017

https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020

https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/

open

Microsoft STRONTIUM Aug 2019

https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/

open

DOJ GRU Indictment Jul 2018

https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf

open

Cybersecurity Advisory GRU Brute Force Campaign July 2021

https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF

open

NSA/FBI Drovorub August 2020

https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

open

SecureWorks TG-4127

https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign

open

Secureworks IRON TWILIGHT Active Measures March 2017

https://www.secureworks.com/research/iron-twilight-supports-active-measures

open

Secureworks IRON TWILIGHT Profile

https://www.secureworks.com/research/threat-profiles/iron-twilight

open

Symantec APT28 Oct 2018

https://www.symantec.com/blogs/election-security/apt28-espionage-military-government

open

Sednit

—

Sofacy

—