Threat-actor profile

← Back to main site

Home/ Threat Actors/ APT28

🇷🇺APT28

🇷🇺 APT28 is a tracked threat actor in the Clankerusecase corpus. Attributed to RU. Primary motivation: State. We map 26 detection use cases to this actor across 154 MITRE ATT&CK techniques, with 9 threat-intel articles citing them. Active in our corpus from 2026-02-13 to 2026-06-12.

crit 8high 1

View full actor card → All threat actors MITRE ATT&CK group spec (G0007) ↗

26Use cases

9Articles

154Techniques

5IOCs

Known aliases

APT28Fancy BearSofacySednitSTRONTIUMForest BlizzardPawn StormTsar TeamGRU Unit 26165IRON TWILIGHTSNAKEMACKERELSwallowtailGroup 74Threat Group-4127TG-4127FROZENLAKEGruesomeLarch

Top techniques

T1190 · Exploit Public-Facing Application T1204.002 · Malicious File T1566 · Phishing

All other tracked techniques

T1001 · Data Obfuscation T1001.001 · Junk Data T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1003.003 · NTDS T1005 · Data from Local System T1014 · Rootkit T1021.002 · SMB/Windows Admin Shares T1025 · Data from Removable Media T1027 · Obfuscated Files or Information T1027.002 · Software Packing T1027.005 · Indicator Removal from Tools T1027.009 · Embedded Payloads T1027.013 · Encrypted/Encoded File T1030 · Data Transfer Size Limits T1036 · Masquerading T1036.005 · Match Legitimate Resource Name or Location T1037.001 · Logon Script (Windows)T1039 · Data from Network Shared Drive T1040 · Network Sniffing T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1053.005 · Scheduled Task T1055 · Process Injection T1055.012 · Process Hollowing T1056.001 · Keylogging T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1059.005 · Visual Basic T1059.007 · JavaScript T1068 · Exploitation for Privilege Escalation T1070 · Indicator Removal T1070.004 · File Deletion T1070.006 · Timestomp T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.003 · Mail Protocols T1071.004 · DNS T1074.001 · Local Data Staging T1074.002 · Remote Data Staging T1078 · Valid Accounts T1078.002 · Domain Accounts T1078.004 · Cloud Accounts T1082 · System Information Discovery T1083 · File and Directory Discovery T1087 · Account Discovery T1090.002 · External Proxy T1090.003 · Multi-hop Proxy T1091 · Replication Through Removable Media T1092 · Communication Through Removable Media T1095 · Non-Application Layer Protocol T1098 · Account Manipulation T1098.001 · Additional Cloud Credentials T1098.002 · Additional Email Delegate Permissions T1102 · Web Service T1102.002 · Bidirectional Communication T1105 · Ingress Tool Transfer T1110 · Brute Force T1110.001 · Password Guessing T1110.003 · Password Spraying T1113 · Screen Capture T1114.002 · Remote Email Collection T1115 · Clipboard Data T1119 · Automated Collection T1120 · Peripheral Device Discovery T1129 · Shared Modules T1133 · External Remote Services T1134.001 · Token Impersonation/Theft T1137.002 · Office Test T1140 · Deobfuscate/Decode Files or Information T1176 · Software Extensions T1189 · Drive-by Compromise T1195.002 · Compromise Software Supply Chain T1199 · Trusted Relationship T1203 · Exploitation for Client Execution T1204.001 · Malicious Link T1204.004 · Malicious Copy and Paste T1210 · Exploitation of Remote Services T1211 · Exploitation for Stealth T1213 · Data from Information Repositories T1213.002 · Sharepoint T1218 · System Binary Proxy Execution T1218.011 · Rundll32 T1219 · Remote Access Tools T1221 · Template Injection T1417.002 · T1417.002 T1437.001 · T1437.001 T1456 · T1456 T1480 · Execution Guardrails T1486 · Data Encrypted for Impact T1489 · Service Stop T1490 · Inhibit System Recovery T1498 · Network Denial of Service T1505.003 · Web Shell T1528 · Steal Application Access Token T1539 · Steal Web Session Cookie T1542.003 · Bootkit T1543.003 · Windows Service T1546.015 · Component Object Model Hijacking T1546.016 · Installer Packages T1547.001 · Registry Run Keys / Startup Folder T1550 · Use Alternate Authentication Material T1550.001 · Application Access Token T1550.002 · Pass the Hash T1552.001 · Credentials In Files T1555.003 · Credentials from Web Browsers T1556 · Modify Authentication Process T1557.004 · Evil Twin T1558 · Steal or Forge Kerberos Tickets T1558.003 · Kerberoasting T1559.002 · Dynamic Data Exchange T1560 · Archive Collected Data T1560.001 · Archive via Utility T1562.001 · T1562.001 T1562.002 · T1562.002 T1562.004 · T1562.004 T1562.006 · T1562.006 T1562.009 · T1562.009 T1564 · Hide Artifacts T1564.001 · Hidden Files and Directories T1564.003 · Hidden Window T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1566.004 · Spearphishing Voice T1567 · Exfiltration Over Web Service T1567.002 · Exfiltration to Cloud Storage T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1573.001 · Symmetric Cryptography T1573.002 · Asymmetric Cryptography T1574.002 · T1574.002 T1583.001 · Domains T1583.003 · Virtual Private Server T1583.006 · Web Services T1584.008 · Network Devices T1586.002 · Email Accounts T1587.001 · Malware T1588.002 · Tool T1588.007 · Artificial Intelligence T1589.001 · Credentials T1591 · Gather Victim Org Information T1595.002 · Vulnerability Scanning T1596 · Search Open Technical Databases T1598 · Phishing for Information T1598.003 · Spearphishing Link T1646 · T1646 T1649 · Steal or Forge Authentication Certificates T1660 · T1660 T1669 · Wi-Fi Networks T1684.001 · Impersonation T1685.005 · Clear Windows Event Logs

Detection use cases (26)

APT28 (Forest Blizzard) Outlook NTLM coercion via CVE-2023-23397 — outbound SMB from outlook.exe to non-corporate IPs AI · profile SΣDD APT28 (Forest Blizzard) GooseEgg post-compromise loader — spoolsv.exe spawning scripting hosts with wayzgoose / execute.bat artifacts (CVE-2 AI · profile SΣDD Asset exposure — vulnerability matches article CVE(s) Internal Network connections to article IPs / domains Internal File hash IOCs — endpoint file/process match Internal NoName057(16) DDoSia client check-in (/client/login, /client/get_targets) Bespoke World Cup 2026 themed lookalike / typosquat domain resolution by corporate hosts Bespoke Beaconing — periodic outbound to small set of destinations Internal Infostealer — non-browser process accessing browser cookie/login DBs Internal Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Microsoft Teams external-tenant chat from unverified IT-helpdesk impersonator Internal RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal 1Password activity from Tor exit node MITRE match 1Password failed sign-in burst MITRE match 1Password impossible-travel sign-in MITRE match Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match

Threat-intel articles (9)

high Fancy Bear Hackers Abuse EdgeRouters and Cloud Services to Launch Stealthy Cyberattacks · 2026-06-12

crit 2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface · 2026-05-28

crit ESET APT Activity Report Q4 2025–Q1 2026 · 2026-05-28

crit Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools · 2026-05-11

crit GopherWhisper: A burrow full of malware · 2026-04-23

crit New NGate variant hides in a trojanized NFC payment app · 2026-04-21

crit EDR killers explained: Beyond the drivers · 2026-03-19

crit Sednit reloaded: Back in the trenches · 2026-03-10

crit Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure · 2026-02-13

Tracked indicators

Domains (4)

freefoodaid.com longsauce.com wellnesscaremed.com wellnessmedcare.org

IP addresses (1)

43.231.113.50

CVEs (3)

CVE-2022-26923 CVE-2023-50224 CVE-2026-21509