APT28
- ID
- G0007
- Associated names
- IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
Techniques used (93)
- T1001.001 Junk Data
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1005 Data from Local System
- T1014 Rootkit
- T1021.002 SMB/Windows Admin Shares
- T1025 Data from Removable Media
- T1027.013 Encrypted/Encoded File
- T1030 Data Transfer Size Limits
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1037.001 Logon Script (Windows)
- T1039 Data from Network Shared Drive
- T1040 Network Sniffing
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1083 File and Directory Discovery
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1098.002 Additional Email Delegate Permissions
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.003 Password Spraying
- T1113 Screen Capture
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1133 External Remote Services
- T1134.001 Token Impersonation/Theft
- T1137.002 Office Test
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1213 Data from Information Repositories
- T1213.002 Sharepoint
- T1218.011 Rundll32
- T1221 Template Injection
- T1498 Network Denial of Service
- T1505.003 Web Shell
- T1528 Steal Application Access Token
- T1542.003 Bootkit
- T1546.015 Component Object Model Hijacking
- T1547.001 Registry Run Keys / Startup Folder
- T1550.001 Application Access Token
- T1550.002 Pass the Hash
- T1557.004 Evil Twin
- T1559.002 Dynamic Data Exchange
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1564.001 Hidden Files and Directories
- T1564.003 Hidden Window
- T1566.001 Spearphishing Attachment
- T1567 Exfiltration Over Web Service
- T1573.001 Symmetric Cryptography
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1584.008 Network Devices
- T1586.002 Email Accounts
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1589.001 Credentials
- T1591 Gather Victim Org Information
- T1595.002 Vulnerability Scanning
- T1596 Search Open Technical Databases
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1669 Wi-Fi Networks
- T1684.001 Impersonation
- T1685.005 Clear Windows Event Logs
Software used (29)
- S0002 Mimikatz
- S0023 CHOPSTICK
- S0039 Net
- S0044 JHUHUGIT
- S0045 ADVSTORESHELL
- S0117 XTunnel
- S0134 Downdelph
- S0135 HIDEDRV
- S0136 USBStealer
- S0137 CORESHELL
- S0138 OLDBAIT
- S0160 certutil
- S0161 XAgentOSX
- S0162 Komplex
- S0174 Responder
- S0183 Tor
- S0191 Winexe
- S0193 Forfiles
- S0243 DealersChoice
- S0250 Koadic
- S0251 Zebrocy
- S0351 Cannon
- S0397 LoJax
- S0410 Fysbis
- S0502 Drovorub
- S0645 Wevtutil
- S1187 reGeorg
- S1205 cipher.exe
- S9035 LAMEHUG
References
- NSA/FBI Drovorub August 2020
- Cybersecurity Advisory GRU Brute Force Campaign July 2021
- DOJ GRU Indictment Jul 2018
- Ars Technica GRU indictment Jul 2018
- Crowdstrike DNC June 2016
- FireEye APT28
- SecureWorks TG-4127
- FireEye APT28 January 2017
- GRIZZLY STEPPE JAR
- Sofacy DealersChoice
- Palo Alto Sofacy 06-2018
- Symantec APT28 Oct 2018
- ESET Zebrocy May 2019
- US District Court Indictment GRU Oct 2018
