apt28-fancy-bear

APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile

APT28 (MITRE ATT&CK G0007) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.

Attribution & motivation

• Sponsor / nation: Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.
• Motivation: Primarily strategic intelligence collection (espionage) aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include influence / information operations (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional destructive / disruptive action (TV5Monde disruption, WADA DDoS).
• Attribution confidence: High. Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI/MFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).

Targeting

• Sectors: Government and diplomatic bodies; defense, military, and aerospace; logistics, transport, and IT/technology firms supporting aid to Ukraine (since 2022); think tanks, NGOs, and political organizations/campaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.
• Regions: NATO and allied states — heavy focus on Ukraine, Western/Eastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.
• Victim profile: High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook/OWA, Roundcube, Yahoo/Google) and edge/network devices as footholds.

Notable campaigns

• 2015-04 — TV5Monde disruption. French broadcaster's 11 channels and online presence knocked offline behind a false "CyberCaliphate" hacktivist persona; French investigators and infrastructure overlap tied it to APT28. (securityaffairs / Wikipedia background)
• 2015 — German Bundestag intrusion. Compromise of the German federal parliament network; the UK later sanctioned GRU Unit 26165 officers for it. (gov.uk)
• 2016 — U.S. election interference (DNC / DCCC / Clinton campaign). Spearphishing and credential theft, lateral movement DCCC→DNC, and hack-and-leak. Detailed in the July 2018 DOJ/Mueller indictment of 12 GRU officers. (justice.gov / FBI)
• 2014-2018 — WADA / USADA / OPCW / Spiez. Remote and close-access ("Wi-Fi") operations against anti-doping and chemical-weapons bodies, including a 2016 DDoS and leak of athlete medical data; charged in the October 2018 DOJ indictment of seven GRU officers. (justice.gov / NPR)
• 2018 — LoJax UEFI rootkit. ESET documented the first in-the-wild UEFI rootkit, used by APT28 for firmware-level persistence surviving OS reinstall. (MITRE software S0397 / ESET)
• 2022-2025 — Western logistics & tech targeting (aid to Ukraine). Joint CISA advisory AA25-141A: password spraying, spearphishing, Outlook NTLM coercion (CVE-2023-23397), Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and WinRAR (CVE-2023-38831) against logistics/IT firms and IP-camera networks. (CISA AA25-141A)
• 2023 — Outlook NTLM (CVE-2023-23397) exploitation. Zero-click NTLM-hash theft via crafted Outlook calendar reminders; documented by Microsoft and Unit 42 ("Fighting Ursa"). (microsoft.com / unit42)
• 2024-04 — GooseEgg / Print Spooler (CVE-2022-38028). Microsoft disclosed APT28's custom GooseEgg launcher abusing Windows Print Spooler for SYSTEM-level privilege escalation; CISA added the CVE to the KEV catalog. (microsoft.com)
• 2023-04 — Cisco router operations. Joint CISA/NCSC advisory AA23-108 on APT28 exploiting SNMP weaknesses (CVE-2017-6742) to deploy "Jaguar Tooth" and conduct reconnaissance on Cisco IOS routers. (CISA AA23-108)
• 2025-04/07 — France formal attribution. France's MFA/ANSSI publicly attributed a decade of intrusions against French entities (incl. TV5Monde lineage and government/defense targets) to APT28. (diplomatie.gouv.fr)

TTPs by ATT&CK tactic

Initial Access

• T1566.001 — Spearphishing attachments: weaponized Office docs and RAR archives (incl. WinRAR CVE-2023-38831).
• T1598.003 — Spearphishing links for credential harvesting (fake login pages on Blogspot, lookalike webmail).
• T1204.001 / T1204.002 — User execution of malicious links and macro-laden files.
• T1190 — Exploit public-facing apps: Exchange (CVE-2020-0688, CVE-2020-17144), Roundcube CVEs, SQLi.
• T1189 — Drive-by compromise via custom exploit kits / XSS.
• T1133 — External remote services: VPN/Tor fronting for brute-force and access.
• T1199 — Trusted relationship: pivoted from DCCC to DNC network.
• T1669 — Wi-Fi networks: "close-access" exploitation of open/nearby Wi-Fi (incl. "nearest-neighbor" pivots).
• T1078 (implied) — Valid accounts obtained via spraying/phishing reused for access.

Execution

• T1059.001 / .003 / .004 / .005 / .006 — PowerShell, Windows cmd/batch, Unix shell (Drovorub), VBScript (Koadic), Python (reGeorg, LAMEHUG).
• T1047 — WMI via Koadic and the LAMEHUG implant.
• T1203 — Exploitation for client execution (CVE-2017-0262 in Office).
• T1569.002 — Service execution via Net/Koadic.
• T1221 — Template injection: Word docs pulling remote weaponized templates.

Persistence

• T1547.001 — Registry Run keys / Startup folder.
• T1037.001 — Logon script via UserInitMprLogonScript.
• T1137.002 — Office Test persistence.
• T1546.015 — COM hijacking (MMDeviceEnumerator).
• T1542.003 — Bootkit (Downdelph) and LoJax UEFI rootkit (firmware persistence).
• T1547.004 / .005 / .006 / .013 — Winlogon Helper DLL (Cannon), SSP, Linux kernel modules (Drovorub), XDG autostart (Fysbis).
• T1543.001 / .002 / .003 — macOS Launch Agent (Komplex), Linux systemd (Fysbis), Windows service (JHUHUGIT).
• T1505.003 — Web shell (reGeorg on OWA).
• T1574.001 — DLL hijacking (Downdelph).

Privilege Escalation

• T1068 — Exploitation for privesc: CVE-2014-4076, CVE-2015-1701, CVE-2015-2387, CVE-2017-0263, and CVE-2022-38028 (Print Spooler, via GooseEgg).
• T1548.002 — UAC bypass (Koadic, Downdelph).
• T1134.001 / .005 — Token impersonation (CVE-2015-1701 → SYSTEM) and SID-History injection (Mimikatz).

Defense Evasion

• T1027 / .002 / .011 / .013 — Obfuscation: base64/XOR/RC4, software packing (Zebrocy), fileless storage (CHOPSTICK), encrypted/encoded files.
• T1036 / .005 — Masquerading: renamed WinRAR, file-extension and location spoofing.
• T1070.004 / .006 — File deletion (CCleaner) and timestomping.
• T1112 — Registry modification (LoJax).
• T1218.005 / .010 / .011 — Mshta/Regsvr32 (Koadic), Rundll32 (CHOPSTICK).
• T1553.004 — Install root certificate via certutil.
• T1564.001 / .003 / .004 — Hidden files, hidden PowerShell windows (-WindowStyle Hidden), NTFS attribute hiding (LoJax).
• T1497 — Sandbox/VM evasion (CHOPSTICK).
• T1202 — Indirect command execution via Forfiles.

Credential Access

• T1110.001 / .003 — Password guessing and large-scale password spraying (reconstituted spray infra, Tor/VPN-fronted).
• T1557.001 — NBT-NS/LLMNR poisoning (Responder).
• T1187 / CVE-2023-23397 — Forced NTLM authentication / coercion via crafted Outlook reminders to capture Net-NTLM hashes.
• T1003.001 / .002 / .003 / .004 / .006 — LSASS dump, SAM via reg save, NTDS via ntdsutil/VSS, LSA secrets, DCSync (Mimikatz).
• T1555.003 / .004 — Browser credential theft (XAgentOSX, Zebrocy, OLDBAIT), Windows Credential Manager.
• T1056.001 — Keylogging.
• T1528 — Steal application access tokens via OAuth apps masquerading as Google/Yahoo.
• T1098.002 — Add mailbox delegate / ApplicationImpersonation permissions via PowerShell (Exchange).
• T1558.001 / .002 — Golden/Silver Kerberos tickets (Mimikatz).
• T1606 — Forge web credentials (phishing pages).
• T1552.001 — Credentials in files (XTunnel).

Discovery

• T1087.001 / .002 — Local/domain account enumeration (Net, LAMEHUG).
• T1083 — File/directory discovery (Forfiles for PDF/Office docs).
• T1046 / T1135 / T1018 — Network service, share, and remote-system discovery (Koadic, Net, Zebrocy).
• T1016 / .002 — Network config and Wi-Fi interface discovery (for close-access ops).
• T1518.001 — Security software discovery (CHOPSTICK, netsh).
• T1482 — Domain trust discovery (LAMEHUG).
• T1201 — Password policy discovery (Net).
• T1082 — System information discovery (many families).

Lateral Movement

• T1021.001 / .002 / .004 — RDP, SMB/admin shares, SSH (via reGeorg tunnel).
• T1550.002 — Pass-the-hash.
• T1210 — Exploitation of remote services (SMB RCE).

Collection

• T1114.002 — Remote email collection from Exchange/OWA mailboxes.
• T1213.002 — Data from SharePoint repositories.
• T1005 / T1039 / T1025 — Local system, network-share, and removable-media collection.
• T1119 — Automated collection (publicly available tools on DCCC/DNC; USBStealer; LAMEHUG).
• T1113 — Screen capture (Cannon, XAgentOSX, Zebrocy).
• T1056.001 — Keylogging for collection.
• T1602 — Data from network devices (Cisco router config via SNMP).
• T1560.001 — Archive via WinRAR (password-protected) / PowerShell Compress-Archive.
• T1074.001 / .002 — Local staging (e.g., C:\ProgramData, pi.log) and remote staging on OWA server.

Command & Control

• T1071.001 / .003 — Web (HTTP/S) and mail protocols (IMAP/POP3/SMTP via Google Mail) for C2.
• T1102.002 — Bidirectional C2 over Google Drive web service.
• T1568.002 — DGA (CHOPSTICK).
• T1008 — Fallback channels (CHOPSTICK, JHUHUGIT, XTunnel).
• T1090.001 / .003 — Internal proxy (netsh portproxy) and multi-hop proxy (Tor/VPN).
• T1572 / T1095 — Protocol tunneling (reGeorg) and non-application-layer protocols (Drovorub).
• T1573.001 / .002 — Symmetric and asymmetric encrypted channels.
• T1105 — Ingress tool transfer.

Exfiltration

• T1041 — Exfil over C2 channel.
• T1048.002 — Exfil over alternate protocol: HTTPS via compromised OWA server.
• T1567 — Exfil over web service (Google Drive).
• T1030 — Data transfer size limits (split archives into <1MB chunks).
• T1052.001 / T1020 — Automated USB exfiltration (USBStealer) for air-gap bridging.

Impact

• T1561.001 — Disk content wipe via cipher.exe.
• T1498 — Network DoS (2016 DDoS against WADA).

Signature tooling & malware

Name	ATT&CK ID	Type	Public/Custom
CHOPSTICK / X-Agent	S0023	Modular Windows implant (DGA, fileless)	Custom
JHUHUGIT / Seduploader	S0044	First-stage Windows implant	Custom
ADVSTORESHELL	S0045	Backdoor with custom archiving	Custom
XTunnel	S0117	Network proxy/tunnel	Custom
CORESHELL / Sofacy	S0137	Windows downloader/backdoor	Custom
Downdelph	S0134	Delphi backdoor + bootkit	Custom
LoJax	S0397	UEFI rootkit (firmware persistence)	Custom
Drovorub	S0502	Linux malware suite + kernel rootkit	Custom
Fysbis	S0410	Linux backdoor	Custom
Komplex / XAgentOSX	S0162 / S0161	macOS trojan / implant	Custom
X-Agent for Android	S0314	Android surveillance	Custom
Zebrocy	S0251	Multi-stage downloader/collector	Custom
Cannon	S0351	Backdoor with email-based exfil	Custom
OLDBAIT	S0138	Credential stealer	Custom
USBStealer	S0136	USB/air-gap exfil	Custom
GooseEgg	(no ATT&CK software ID assigned)	Print Spooler privesc launcher (CVE-2022-38028)	Custom
LAMEHUG	S9035	LLM-assisted post-compromise implant	Custom
reGeorg	S1187	Web shell / SOCKS tunnel	Public (Living-off-tooling)
Koadic	S0250	Post-exploitation framework	Public
Mimikatz	S0002	Credential dumping	Public
Responder	S0174	LLMNR/NBT-NS poisoning	Public
Tor	S0183	Anonymity / proxy	Public
Net / netsh / certutil / Wevtutil / Forfiles	S0039 / S0108 / S0160 / S0645 / S0193	LOLBins	Built-in

Note: "GooseEgg" is a Microsoft-attributed custom tool; it is not the same as ATT&CK software S1145 (Pikabot), so no false software ID is assigned here.

Emulation guidance (Decepticon)

Authorized-use caveat: Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run destructive (T1561/T1498) or firmware (LoJax-style) actions outside an explicitly sanctioned, isolated lab.

Map APT28's signature plays to Decepticon's own capabilities:

• Initial access — credential ops (T1110.003, T1598.003, T1566.001). Use the phishing/credential-harvest skill to stand up lookalike webmail login pages; drive slow, low-and-slow password spraying (~few attempts/account/hour) against in-scope OWA/M365 endpoints, fronted through rotating egress to mimic Tor/VPN spray infra. Stage macro/RAR lures with the payload-builder; if WinRAR is in scope, emulate CVE-2023-38831 archive lures.
• NTLM coercion (T1187 / CVE-2023-23397, T1557.001). With the AD/lateral-movement skill, run Responder for LLMNR/NBT-NS poisoning and emulate Outlook-reminder NTLM coercion to capture Net-NTLM hashes, then relay or crack offline. This is APT28's defining 2023-2025 play — prioritize it.
• Privilege escalation (T1068, T1548.002). Use the privesc/defense-evasion skill to emulate GooseEgg-style Print Spooler abuse (CVE-2022-38028) for SYSTEM in a patched-vs-unpatched lab, and UAC bypass chains analogous to Koadic/Downdelph.
• Credential access (T1003., T1558., T1550.002). Drive the AD skill / Mimikatz for LSASS dump, DCSync, golden/silver tickets, and pass-the-hash — mirroring APT28's domain-takeover pattern.
• C2 (T1071.001, T1102.002, T1090, T1572). Use Sliver (c2 skill) over HTTPS as the primary channel; add a mail-protocol or Google-Drive web-service profile to emulate Cannon/Drive C2, and chain netsh portproxy internal proxies + reGeorg-style web-shell tunneling for pivoting.
• Cloud / token theft (T1528, T1098.002, T1114.002, T1213.002). With the cloud/M365 skill, emulate OAuth-app consent abuse, ApplicationImpersonation/delegate-permission grants, and bulk mailbox + SharePoint collection.
• Collection & exfil (T1560.001, T1030, T1048.002, T1567). Use bash/PowerShell to archive with password-protected RAR/Compress-Archive, split into <1MB chunks, and exfil over HTTPS through a compromised OWA-equivalent or a web service to reproduce the signature exfil pattern.
• Edge devices (T1602, T1133). Where routers/IP cameras are in scope, emulate SNMP/credential weaknesses (cf. AA23-108) to recon network-device config — APT28 favors edge footholds.

Detection & defense

• NTLM coercion / CVE-2023-23397: Patch Outlook; block outbound SMB (TCP 445) and WebDAV at the perimeter; add high-value users to the Protected Users group; hunt for Exchange messages with PidLidReminderFileParameter UNC paths; alert on outbound NTLM to external hosts.
• Password spraying (T1110.003): Enforce phishing-resistant MFA; alert on distributed low-rate auth failures across many accounts from rotating/Tor/VPN IPs; disable legacy/basic auth on M365/OWA; monitor impossible-travel and new-ASN sign-ins.
• Print Spooler / GooseEgg (CVE-2022-38028): Apply Oct-2022+ patches; disable the Spooler where not needed; monitor for spoolsv.exe spawning cmd/PowerShell and writes to Spooler driver/JS-constraints paths.
• Credential dumping (T1003.*): Enable LSA protection (RunAsPPL) and Credential Guard; alert on LSASS handle access, ntdsutil/vssadmin shadow-copy creation, and reg save of SAM/SYSTEM/SECURITY; monitor DCSync replication from non-DC accounts.
• OAuth/delegation abuse (T1528, T1098.002): Audit enterprise app consent and mailbox Add-MailboxPermission/ApplicationImpersonation role grants; restrict user consent; review delegate/forwarding rules.
• Web shells & tunneling (T1505.003, T1572, T1090.001): Monitor OWA/IIS directories for new aspx/script files (reGeorg); alert on netsh interface portproxy add; baseline web-server child processes.
• Persistence (T1547, T1137.002, T1542.003): Monitor Run keys, UserInitMprLogonScript, Office Test registry keys; deploy Secure Boot + firmware integrity (against LoJax-class UEFI implants).
• Edge/network devices (T1602): Replace default SNMP community strings, restrict SNMP to management VLANs, patch Cisco IOS (cf. CVE-2017-6742), and monitor for unexpected config reads (Jaguar Tooth pattern).
• Exfiltration (T1030, T1048.002, T1567): DLP/egress monitoring for chunked password-protected archives and uploads to Google Drive / unusual HTTPS endpoints, especially staged from mail servers.

Sources

• https://attack.mitre.org/groups/G0007/
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108
• https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
• https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
• https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/
• https://www.justice.gov/archives/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and
• https://www.fbi.gov/news/stories/russian-gru-officers-charged-with-hacking-100418
• https://www.gov.uk/government/news/uk-enforces-new-sanctions-against-russia-for-cyber-attack-on-german-parliament
• https://www.diplomatie.gouv.fr/en/country-files/russia/news/2025/article/russia-attribution-of-cyber-attacks-on-france-to-the-russian-military
• https://attack.mitre.org/software/S0397/