MITRE ATT&CK / Groups / G0007

APT28

ID
G0007
Associated names
IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch
Source
attack.mitre.org
MITRE last modified
1 Aug 2026

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Techniques used (93)

Software used (29)

References

  1. NSA/FBI Drovorub August 2020
  2. Cybersecurity Advisory GRU Brute Force Campaign July 2021
  3. DOJ GRU Indictment Jul 2018
  4. Ars Technica GRU indictment Jul 2018
  5. Crowdstrike DNC June 2016
  6. FireEye APT28
  7. SecureWorks TG-4127
  8. FireEye APT28 January 2017
  9. GRIZZLY STEPPE JAR
  10. Sofacy DealersChoice
  11. Palo Alto Sofacy 06-2018
  12. Symantec APT28 Oct 2018
  13. ESET Zebrocy May 2019
  14. US District Court Indictment GRU Oct 2018