[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78GSYTPWA55RXZ2H1VR83HT":3,"skill-same:01M78GSYTPWA55RXZ2H1VR83HT":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":13,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M78GSYTPWA55RXZ2H1VR83HT","apt28-fancy-bear",null,"Adversary-emulation profile for APT28 (G0007 \u002F Fancy Bear \u002F Forest Blizzard \u002F Sofacy \u002F STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.","dnzengou\u002Fevo-decepticon","dnzengou","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F7807581?v=4","01M75KKJA3F5ZP7CA10MB2AEXC","01M78GP0FED2V1CDPB1N6G0CTH",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt28-fancy-bear\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: apt28-fancy-bear\ndescription: \"Adversary-emulation profile for APT28 (G0007 \u002F Fancy Bear \u002F Forest Blizzard \u002F Sofacy \u002F STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.\"\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: adversary-emulation\n  when_to_use: \"APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, STRONTIUM, Pawn Storm, GRU 26165, G0007, Russian GRU espionage emulation, NTLM relay \u002F CVE-2023-23397 Outlook, GooseEgg print spooler, password spraying, credential harvesting, NATO\u002FUkraine logistics targeting, election interference TTPs\"\n  tags: apt28, fancy-bear, forest-blizzard, sofacy, strontium, gru, russia, espionage, nation-state, g0007, adversary-emulation, mitre-attack\n  mitre_attack: T1583.001, T1583.003, T1583.006, T1586.002, T1595.002, T1589.001, T1591, T1598.003, T1566.001, T1204.001, T1204.002, T1669, T1190, T1189, T1203, T1210, T1221, T1133, T1199, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1047, T1204, T1569.002, T1547.001, T1037.001, T1137.002, T1546.015, T1542.003, T1547.004, T1547.005, T1547.006, T1547.013, T1543.001, T1543.002, T1543.003, T1505.003, T1574.001, T1548.002, T1068, T1134.001, T1134.005, T1027, T1027.002, T1027.011, T1027.013, T1036, T1036.005, T1070.004, T1070.006, T1112, T1218.005, T1218.010, T1218.011, T1553.004, T1564.001, T1564.003, T1564.004, T1497, T1202, T1003.001, T1003.002, T1003.003, T1003.004, T1003.006, T1110.001, T1110.003, T1555.003, T1555.004, T1056.001, T1557.001, T1557.004, T1040, T1528, T1552.001, T1098.002, T1558.001, T1558.002, T1606, T1087.001, T1087.002, T1083, T1046, T1135, T1518.001, T1018, T1082, T1016, T1016.002, T1482, T1201, T1021.001, T1021.002, T1021.004, T1550.002, T1119, T1005, T1039, T1025, T1113, T1114.002, T1213.002, T1560.001, T1074.001, T1074.002, T1071.001, T1071.003, T1090.001, T1090.003, T1102.002, T1105, T1573.001, T1573.002, T1568.002, T1008, T1095, T1572, T1041, T1048.002, T1567, T1052.001, T1020, T1030, T1561.001, T1498, T1602\n---\n\n# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile\n\nAPT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows\u002FLinux\u002FmacOS\u002FAndroid, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive\u002FDDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.\n\n## Attribution & motivation\n\n- **Sponsor \u002F nation:** Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.\n- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include **influence \u002F information operations** (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional **destructive \u002F disruptive** action (TV5Monde disruption, WADA DDoS).\n- **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI\u002FMFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).\n\n## Targeting\n\n- **Sectors:** Government and diplomatic bodies; defense, military, and aerospace; **logistics, transport, and IT\u002Ftechnology firms supporting aid to Ukraine** (since 2022); think tanks, NGOs, and political organizations\u002Fcampaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.\n- **Regions:** NATO and allied states — heavy focus on Ukraine, Western\u002FEastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.\n- **Victim profile:** High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook\u002FOWA, Roundcube, Yahoo\u002FGoogle) and edge\u002Fnetwork devices as footholds.\n\n## Notable campaigns\n\n- **2015-04 — TV5Monde disruption.** French broadcaster's 11 channels and online presence knocked offline behind a false \"CyberCaliphate\" hacktivist persona; French investigators and infrastructure overlap tied it to APT28. (securityaffairs \u002F Wikipedia background)\n- **2015 — German Bundestag intrusion.** Compromise of the German federal parliament network; the UK later sanctioned GRU Unit 26165 officers for it. (gov.uk)\n- **2016 — U.S. election interference (DNC \u002F DCCC \u002F Clinton campaign).** Spearphishing and credential theft, lateral movement DCCC→DNC, and hack-and-leak. Detailed in the July 2018 DOJ\u002FMueller indictment of 12 GRU officers. (justice.gov \u002F FBI)\n- **2014-2018 — WADA \u002F USADA \u002F OPCW \u002F Spiez.** Remote and close-access (\"Wi-Fi\") operations against anti-doping and chemical-weapons bodies, including a 2016 DDoS and leak of athlete medical data; charged in the October 2018 DOJ indictment of seven GRU officers. (justice.gov \u002F NPR)\n- **2018 — LoJax UEFI rootkit.** ESET documented the first in-the-wild UEFI rootkit, used by APT28 for firmware-level persistence surviving OS reinstall. (MITRE software S0397 \u002F ESET)\n- **2022-2025 — Western logistics & tech targeting (aid to Ukraine).** Joint CISA advisory **AA25-141A**: password spraying, spearphishing, Outlook NTLM coercion (CVE-2023-23397), Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and WinRAR (CVE-2023-38831) against logistics\u002FIT firms and IP-camera networks. (CISA AA25-141A)\n- **2023 — Outlook NTLM (CVE-2023-23397) exploitation.** Zero-click NTLM-hash theft via crafted Outlook calendar reminders; documented by Microsoft and Unit 42 (\"Fighting Ursa\"). (microsoft.com \u002F unit42)\n- **2024-04 — GooseEgg \u002F Print Spooler (CVE-2022-38028).** Microsoft disclosed APT28's custom GooseEgg launcher abusing Windows Print Spooler for SYSTEM-level privilege escalation; CISA added the CVE to the KEV catalog. (microsoft.com)\n- **2023-04 — Cisco router operations.** Joint CISA\u002FNCSC advisory **AA23-108** on APT28 exploiting SNMP weaknesses (CVE-2017-6742) to deploy \"Jaguar Tooth\" and conduct reconnaissance on Cisco IOS routers. (CISA AA23-108)\n- **2025-04\u002F07 — France formal attribution.** France's MFA\u002FANSSI publicly attributed a decade of intrusions against French entities (incl. TV5Monde lineage and government\u002Fdefense targets) to APT28. (diplomatie.gouv.fr)\n\n## TTPs by ATT&CK tactic\n\n### Initial Access\n- **T1566.001** — Spearphishing attachments: weaponized Office docs and RAR archives (incl. WinRAR CVE-2023-38831).\n- **T1598.003** — Spearphishing links for credential harvesting (fake login pages on Blogspot, lookalike webmail).\n- **T1204.001 \u002F T1204.002** — User execution of malicious links and macro-laden files.\n- **T1190** — Exploit public-facing apps: Exchange (CVE-2020-0688, CVE-2020-17144), Roundcube CVEs, SQLi.\n- **T1189** — Drive-by compromise via custom exploit kits \u002F XSS.\n- **T1133** — External remote services: VPN\u002FTor fronting for brute-force and access.\n- **T1199** — Trusted relationship: pivoted from DCCC to DNC network.\n- **T1669** — Wi-Fi networks: \"close-access\" exploitation of open\u002Fnearby Wi-Fi (incl. \"nearest-neighbor\" pivots).\n- **T1078 (implied)** — Valid accounts obtained via spraying\u002Fphishing reused for access.\n\n### Execution\n- **T1059.001 \u002F .003 \u002F .004 \u002F .005 \u002F .006** — PowerShell, Windows cmd\u002Fbatch, Unix shell (Drovorub), VBScript (Koadic), Python (reGeorg, LAMEHUG).\n- **T1047** — WMI via Koadic and the LAMEHUG implant.\n- **T1203** — Exploitation for client execution (CVE-2017-0262 in Office).\n- **T1569.002** — Service execution via Net\u002FKoadic.\n- **T1221** — Template injection: Word docs pulling remote weaponized templates.\n\n### Persistence\n- **T1547.001** — Registry Run keys \u002F Startup folder.\n- **T1037.001** — Logon script via `UserInitMprLogonScript`.\n- **T1137.002** — Office Test persistence.\n- **T1546.015** — COM hijacking (MMDeviceEnumerator).\n- **T1542.003** — Bootkit (Downdelph) and **LoJax UEFI rootkit** (firmware persistence).\n- **T1547.004 \u002F .005 \u002F .006 \u002F .013** — Winlogon Helper DLL (Cannon), SSP, Linux kernel modules (Drovorub), XDG autostart (Fysbis).\n- **T1543.001 \u002F .002 \u002F .003** — macOS Launch Agent (Komplex), Linux systemd (Fysbis), Windows service (JHUHUGIT).\n- **T1505.003** — Web shell (reGeorg on OWA).\n- **T1574.001** — DLL hijacking (Downdelph).\n\n### Privilege Escalation\n- **T1068** — Exploitation for privesc: CVE-2014-4076, CVE-2015-1701, CVE-2015-2387, CVE-2017-0263, and **CVE-2022-38028 (Print Spooler, via GooseEgg)**.\n- **T1548.002** — UAC bypass (Koadic, Downdelph).\n- **T1134.001 \u002F .005** — Token impersonation (CVE-2015-1701 → SYSTEM) and SID-History injection (Mimikatz).\n\n### Defense Evasion\n- **T1027 \u002F .002 \u002F .011 \u002F .013** — Obfuscation: base64\u002FXOR\u002FRC4, software packing (Zebrocy), fileless storage (CHOPSTICK), encrypted\u002Fencoded files.\n- **T1036 \u002F .005** — Masquerading: renamed WinRAR, file-extension and location spoofing.\n- **T1070.004 \u002F .006** — File deletion (CCleaner) and timestomping.\n- **T1112** — Registry modification (LoJax).\n- **T1218.005 \u002F .010 \u002F .011** — Mshta\u002FRegsvr32 (Koadic), Rundll32 (CHOPSTICK).\n- **T1553.004** — Install root certificate via certutil.\n- **T1564.001 \u002F .003 \u002F .004** — Hidden files, hidden PowerShell windows (`-WindowStyle Hidden`), NTFS attribute hiding (LoJax).\n- **T1497** — Sandbox\u002FVM evasion (CHOPSTICK).\n- **T1202** — Indirect command execution via Forfiles.\n\n### Credential Access\n- **T1110.001 \u002F .003** — Password guessing and **large-scale password spraying** (reconstituted spray infra, Tor\u002FVPN-fronted).\n- **T1557.001** — NBT-NS\u002FLLMNR poisoning (Responder).\n- **T1187 \u002F CVE-2023-23397** — **Forced NTLM authentication \u002F coercion** via crafted Outlook reminders to capture Net-NTLM hashes.\n- **T1003.001 \u002F .002 \u002F .003 \u002F .004 \u002F .006** — LSASS dump, SAM via `reg save`, NTDS via ntdsutil\u002FVSS, LSA secrets, DCSync (Mimikatz).\n- **T1555.003 \u002F .004** — Browser credential theft (XAgentOSX, Zebrocy, OLDBAIT), Windows Credential Manager.\n- **T1056.001** — Keylogging.\n- **T1528** — Steal application access tokens via OAuth apps masquerading as Google\u002FYahoo.\n- **T1098.002** — Add mailbox delegate \u002F ApplicationImpersonation permissions via PowerShell (Exchange).\n- **T1558.001 \u002F .002** — Golden\u002FSilver Kerberos tickets (Mimikatz).\n- **T1606** — Forge web credentials (phishing pages).\n- **T1552.001** — Credentials in files (XTunnel).\n\n### Discovery\n- **T1087.001 \u002F .002** — Local\u002Fdomain account enumeration (Net, LAMEHUG).\n- **T1083** — File\u002Fdirectory discovery (Forfiles for PDF\u002FOffice docs).\n- **T1046 \u002F T1135 \u002F T1018** — Network service, share, and remote-system discovery (Koadic, Net, Zebrocy).\n- **T1016 \u002F .002** — Network config and **Wi-Fi interface discovery** (for close-access ops).\n- **T1518.001** — Security software discovery (CHOPSTICK, netsh).\n- **T1482** — Domain trust discovery (LAMEHUG).\n- **T1201** — Password policy discovery (Net).\n- **T1082** — System information discovery (many families).\n\n### Lateral Movement\n- **T1021.001 \u002F .002 \u002F .004** — RDP, SMB\u002Fadmin shares, SSH (via reGeorg tunnel).\n- **T1550.002** — Pass-the-hash.\n- **T1210** — Exploitation of remote services (SMB RCE).\n\n### Collection\n- **T1114.002** — Remote email collection from Exchange\u002FOWA mailboxes.\n- **T1213.002** — Data from SharePoint repositories.\n- **T1005 \u002F T1039 \u002F T1025** — Local system, network-share, and removable-media collection.\n- **T1119** — Automated collection (publicly available tools on DCCC\u002FDNC; USBStealer; LAMEHUG).\n- **T1113** — Screen capture (Cannon, XAgentOSX, Zebrocy).\n- **T1056.001** — Keylogging for collection.\n- **T1602** — Data from network devices (Cisco router config via SNMP).\n- **T1560.001** — Archive via WinRAR (password-protected) \u002F PowerShell `Compress-Archive`.\n- **T1074.001 \u002F .002** — Local staging (e.g., `C:\\ProgramData`, `pi.log`) and remote staging on OWA server.\n\n### Command & Control\n- **T1071.001 \u002F .003** — Web (HTTP\u002FS) and mail protocols (IMAP\u002FPOP3\u002FSMTP via Google Mail) for C2.\n- **T1102.002** — Bidirectional C2 over Google Drive web service.\n- **T1568.002** — DGA (CHOPSTICK).\n- **T1008** — Fallback channels (CHOPSTICK, JHUHUGIT, XTunnel).\n- **T1090.001 \u002F .003** — Internal proxy (`netsh portproxy`) and multi-hop proxy (Tor\u002FVPN).\n- **T1572 \u002F T1095** — Protocol tunneling (reGeorg) and non-application-layer protocols (Drovorub).\n- **T1573.001 \u002F .002** — Symmetric and asymmetric encrypted channels.\n- **T1105** — Ingress tool transfer.\n\n### Exfiltration\n- **T1041** — Exfil over C2 channel.\n- **T1048.002** — Exfil over alternate protocol: HTTPS via compromised OWA server.\n- **T1567** — Exfil over web service (Google Drive).\n- **T1030** — Data transfer size limits (split archives into \u003C1MB chunks).\n- **T1052.001 \u002F T1020** — Automated USB exfiltration (USBStealer) for air-gap bridging.\n\n### Impact\n- **T1561.001** — Disk content wipe via `cipher.exe`.\n- **T1498** — Network DoS (2016 DDoS against WADA).\n\n## Signature tooling & malware\n\n| Name | ATT&CK ID | Type | Public\u002FCustom |\n|---|---|---|---|\n| CHOPSTICK \u002F X-Agent | S0023 | Modular Windows implant (DGA, fileless) | Custom |\n| JHUHUGIT \u002F Seduploader | S0044 | First-stage Windows implant | Custom |\n| ADVSTORESHELL | S0045 | Backdoor with custom archiving | Custom |\n| XTunnel | S0117 | Network proxy\u002Ftunnel | Custom |\n| CORESHELL \u002F Sofacy | S0137 | Windows downloader\u002Fbackdoor | Custom |\n| Downdelph | S0134 | Delphi backdoor + bootkit | Custom |\n| LoJax | S0397 | **UEFI rootkit** (firmware persistence) | Custom |\n| Drovorub | S0502 | Linux malware suite + kernel rootkit | Custom |\n| Fysbis | S0410 | Linux backdoor | Custom |\n| Komplex \u002F XAgentOSX | S0162 \u002F S0161 | macOS trojan \u002F implant | Custom |\n| X-Agent for Android | S0314 | Android surveillance | Custom |\n| Zebrocy | S0251 | Multi-stage downloader\u002Fcollector | Custom |\n| Cannon | S0351 | Backdoor with email-based exfil | Custom |\n| OLDBAIT | S0138 | Credential stealer | Custom |\n| USBStealer | S0136 | USB\u002Fair-gap exfil | Custom |\n| GooseEgg | (no ATT&CK software ID assigned) | Print Spooler privesc launcher (CVE-2022-38028) | Custom |\n| LAMEHUG | S9035 | LLM-assisted post-compromise implant | Custom |\n| reGeorg | S1187 | Web shell \u002F SOCKS tunnel | Public (Living-off-tooling) |\n| Koadic | S0250 | Post-exploitation framework | Public |\n| Mimikatz | S0002 | Credential dumping | Public |\n| Responder | S0174 | LLMNR\u002FNBT-NS poisoning | Public |\n| Tor | S0183 | Anonymity \u002F proxy | Public |\n| Net \u002F netsh \u002F certutil \u002F Wevtutil \u002F Forfiles | S0039 \u002F S0108 \u002F S0160 \u002F S0645 \u002F S0193 | LOLBins | Built-in |\n\n> Note: \"GooseEgg\" is a Microsoft-attributed custom tool; it is **not** the same as ATT&CK software S1145 (Pikabot), so no false software ID is assigned here.\n\n## Emulation guidance (Decepticon)\n\n> **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run destructive (T1561\u002FT1498) or firmware (LoJax-style) actions outside an explicitly sanctioned, isolated lab.\n\nMap APT28's signature plays to Decepticon's own capabilities:\n\n- **Initial access — credential ops (T1110.003, T1598.003, T1566.001).** Use the phishing\u002Fcredential-harvest skill to stand up lookalike webmail login pages; drive **slow, low-and-slow password spraying** (~few attempts\u002Faccount\u002Fhour) against in-scope OWA\u002FM365 endpoints, fronted through rotating egress to mimic Tor\u002FVPN spray infra. Stage macro\u002FRAR lures with the payload-builder; if WinRAR is in scope, emulate CVE-2023-38831 archive lures.\n- **NTLM coercion (T1187 \u002F CVE-2023-23397, T1557.001).** With the AD\u002Flateral-movement skill, run **Responder** for LLMNR\u002FNBT-NS poisoning and emulate Outlook-reminder NTLM coercion to capture Net-NTLM hashes, then relay or crack offline. This is APT28's defining 2023-2025 play — prioritize it.\n- **Privilege escalation (T1068, T1548.002).** Use the privesc\u002Fdefense-evasion skill to emulate **GooseEgg-style Print Spooler abuse (CVE-2022-38028)** for SYSTEM in a patched-vs-unpatched lab, and UAC bypass chains analogous to Koadic\u002FDowndelph.\n- **Credential access (T1003.*, T1558.*, T1550.002).** Drive the AD skill \u002F **Mimikatz** for LSASS dump, DCSync, golden\u002Fsilver tickets, and pass-the-hash — mirroring APT28's domain-takeover pattern.\n- **C2 (T1071.001, T1102.002, T1090, T1572).** Use **Sliver** (c2 skill) over HTTPS as the primary channel; add a **mail-protocol or Google-Drive web-service profile** to emulate Cannon\u002FDrive C2, and chain `netsh portproxy` internal proxies + reGeorg-style web-shell tunneling for pivoting.\n- **Cloud \u002F token theft (T1528, T1098.002, T1114.002, T1213.002).** With the cloud\u002FM365 skill, emulate OAuth-app consent abuse, ApplicationImpersonation\u002Fdelegate-permission grants, and bulk mailbox + SharePoint collection.\n- **Collection & exfil (T1560.001, T1030, T1048.002, T1567).** Use bash\u002FPowerShell to archive with password-protected RAR\u002F`Compress-Archive`, **split into \u003C1MB chunks**, and exfil over HTTPS through a compromised OWA-equivalent or a web service to reproduce the signature exfil pattern.\n- **Edge devices (T1602, T1133).** Where routers\u002FIP cameras are in scope, emulate SNMP\u002Fcredential weaknesses (cf. AA23-108) to recon network-device config — APT28 favors edge footholds.\n\n## Detection & defense\n\n- **NTLM coercion \u002F CVE-2023-23397:** Patch Outlook; block outbound SMB (TCP 445) and WebDAV at the perimeter; add high-value users to the **Protected Users** group; hunt for Exchange messages with `PidLidReminderFileParameter` UNC paths; alert on outbound NTLM to external hosts.\n- **Password spraying (T1110.003):** Enforce **phishing-resistant MFA**; alert on distributed low-rate auth failures across many accounts from rotating\u002FTor\u002FVPN IPs; disable legacy\u002Fbasic auth on M365\u002FOWA; monitor impossible-travel and new-ASN sign-ins.\n- **Print Spooler \u002F GooseEgg (CVE-2022-38028):** Apply Oct-2022+ patches; disable the Spooler where not needed; monitor for `spoolsv.exe` spawning cmd\u002FPowerShell and writes to Spooler driver\u002FJS-constraints paths.\n- **Credential dumping (T1003.*):** Enable LSA protection (RunAsPPL) and Credential Guard; alert on LSASS handle access, `ntdsutil`\u002F`vssadmin` shadow-copy creation, and `reg save` of SAM\u002FSYSTEM\u002FSECURITY; monitor DCSync replication from non-DC accounts.\n- **OAuth\u002Fdelegation abuse (T1528, T1098.002):** Audit enterprise app consent and mailbox `Add-MailboxPermission`\u002FApplicationImpersonation role grants; restrict user consent; review delegate\u002Fforwarding rules.\n- **Web shells & tunneling (T1505.003, T1572, T1090.001):** Monitor OWA\u002FIIS directories for new aspx\u002Fscript files (reGeorg); alert on `netsh interface portproxy add`; baseline web-server child processes.\n- **Persistence (T1547, T1137.002, T1542.003):** Monitor Run keys, `UserInitMprLogonScript`, Office Test registry keys; deploy Secure Boot + firmware integrity (against LoJax-class UEFI implants).\n- **Edge\u002Fnetwork devices (T1602):** Replace default SNMP community strings, restrict SNMP to management VLANs, patch Cisco IOS (cf. CVE-2017-6742), and monitor for unexpected config reads (Jaguar Tooth pattern).\n- **Exfiltration (T1030, T1048.002, T1567):** DLP\u002Fegress monitoring for chunked password-protected archives and uploads to Google Drive \u002F unusual HTTPS endpoints, especially staged from mail servers.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0007\u002F\n- https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa25-141a\n- https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa23-108\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F04\u002F22\u002Fanalyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials\u002F\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2023\u002F03\u002F24\u002Fguidance-for-investigating-attacks-using-cve-2023-23397\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Frussian-apt-fighting-ursa-exploits-cve-2023-233397\u002F\n- https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fus-charges-russian-gru-officers-international-hacking-and-related-influence-and\n- https:\u002F\u002Fwww.fbi.gov\u002Fnews\u002Fstories\u002Frussian-gru-officers-charged-with-hacking-100418\n- https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fnews\u002Fuk-enforces-new-sanctions-against-russia-for-cyber-attack-on-german-parliament\n- https:\u002F\u002Fwww.diplomatie.gouv.fr\u002Fen\u002Fcountry-files\u002Frussia\u002Fnews\u002F2025\u002Farticle\u002Frussia-attribution-of-cyber-attacks-on-france-to-the-russian-military\n- https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0397\u002F\n","# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile\n\nAPT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows\u002FLinux\u002FmacOS\u002FAndroid, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive\u002FDDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.\n\n## Attribution & motivation\n\n- **Sponsor \u002F nation:** Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.\n- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include **influence \u002F information operations** (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional **destructive \u002F disruptive** action (TV5Monde disruption, WADA DDoS).\n- **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI\u002FMFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).\n\n## Targeting\n\n- **Sectors:** Government and diplomatic bodies; defense, military, and aerospace; **logistics, transport, and IT\u002Ftechnology firms supporting aid to Ukraine** (since 2022); think tanks, NGOs, and political organizations\u002Fcampaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.\n- **Regions:** NATO and allied states — heavy focus on Ukraine, Western\u002FEastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.\n- **Victim profile:** High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook\u002FOWA, Roundcube, Yahoo\u002FGoogle) and edge\u002Fnetwork devices as footholds.\n\n## Notable campaigns\n\n- **2015-04 — TV5Monde disruption.** French broadcaster's 11 channels and online presence knocked offline behind a false \"CyberCaliphate\" hacktivist persona; French investigators and infrastructure overlap tied it to APT28. (securityaffairs \u002F Wikipedia background)\n- **2015 — German Bundestag intrusion.** Compromise of the German federal parliament network; the UK later sanctioned GRU Unit 26165 officers for it. (gov.uk)\n- **2016 — U.S. election interference (DNC \u002F DCCC \u002F Clinton campaign).** Spearphishing and credential theft, lateral movement DCCC→DNC, and hack-and-leak. Detailed in the July 2018 DOJ\u002FMueller indictment of 12 GRU officers. (justice.gov \u002F FBI)\n- **2014-2018 — WADA \u002F USADA \u002F OPCW \u002F Spiez.** Remote and close-access (\"Wi-Fi\") operations against anti-doping and chemical-weapons bodies, including a 2016 DDoS and leak of athlete medical data; charged in the October 2018 DOJ indictment of seven GRU officers. (justice.gov \u002F NPR)\n- **2018 — LoJax UEFI rootkit.** ESET documented the first in-the-wild UEFI rootkit, used by APT28 for firmware-level persistence surviving OS reinstall. (MITRE software S0397 \u002F ESET)\n- **2022-2025 — Western logistics & tech targeting (aid to Ukraine).** Joint CISA advisory **AA25-141A**: password spraying, spearphishing, Outlook NTLM coercion (CVE-2023-23397), Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and WinRAR (CVE-2023-38831) against logistics\u002FIT firms and IP-camera networks. (CISA AA25-141A)\n- **2023 — Outlook NTLM (CVE-2023-23397) exploitation.** Zero-click NTLM-hash theft via crafted Outlook calendar reminders; documented by Microsoft and Unit 42 (\"Fighting Ursa\"). (microsoft.com \u002F unit42)\n- **2024-04 — GooseEgg \u002F Print Spooler (CVE-2022-38028).** Microsoft disclosed APT28's custom GooseEgg launcher abusing Windows Print Spooler for SYSTEM-level privilege escalation; CISA added the CVE to the KEV catalog. (microsoft.com)\n- **2023-04 — Cisco router operations.** Joint CISA\u002FNCSC advisory **AA23-108** on APT28 exploiting SNMP weaknesses (CVE-2017-6742) to deploy \"Jaguar Tooth\" and conduct reconnaissance on Cisco IOS routers. (CISA AA23-108)\n- **2025-04\u002F07 — France formal attribution.** France's MFA\u002FANSSI publicly attributed a decade of intrusions against French entities (incl. TV5Monde lineage and government\u002Fdefense targets) to APT28. (diplomatie.gouv.fr)\n\n## TTPs by ATT&CK tactic\n\n### Initial Access\n- **T1566.001** — Spearphishing attachments: weaponized Office docs and RAR archives (incl. WinRAR CVE-2023-38831).\n- **T1598.003** — Spearphishing links for credential harvesting (fake login pages on Blogspot, lookalike webmail).\n- **T1204.001 \u002F T1204.002** — User execution of malicious links and macro-laden files.\n- **T1190** — Exploit public-facing apps: Exchange (CVE-2020-0688, CVE-2020-17144), Roundcube CVEs, SQLi.\n- **T1189** — Drive-by compromise via custom exploit kits \u002F XSS.\n- **T1133** — External remote services: VPN\u002FTor fronting for brute-force and access.\n- **T1199** — Trusted relationship: pivoted from DCCC to DNC network.\n- **T1669** — Wi-Fi networks: \"close-access\" exploitation of open\u002Fnearby Wi-Fi (incl. \"nearest-neighbor\" pivots).\n- **T1078 (implied)** — Valid accounts obtained via spraying\u002Fphishing reused for access.\n\n### Execution\n- **T1059.001 \u002F .003 \u002F .004 \u002F .005 \u002F .006** — PowerShell, Windows cmd\u002Fbatch, Unix shell (Drovorub), VBScript (Koadic), Python (reGeorg, LAMEHUG).\n- **T1047** — WMI via Koadic and the LAMEHUG implant.\n- **T1203** — Exploitation for client execution (CVE-2017-0262 in Office).\n- **T1569.002** — Service execution via Net\u002FKoadic.\n- **T1221** — Template injection: Word docs pulling remote weaponized templates.\n\n### Persistence\n- **T1547.001** — Registry Run keys \u002F Startup folder.\n- **T1037.001** — Logon script via `UserInitMprLogonScript`.\n- **T1137.002** — Office Test persistence.\n- **T1546.015** — COM hijacking (MMDeviceEnumerator).\n- **T1542.003** — Bootkit (Downdelph) and **LoJax UEFI rootkit** (firmware persistence).\n- **T1547.004 \u002F .005 \u002F .006 \u002F .013** — Winlogon Helper DLL (Cannon), SSP, Linux kernel modules (Drovorub), XDG autostart (Fysbis).\n- **T1543.001 \u002F .002 \u002F .003** — macOS Launch Agent (Komplex), Linux systemd (Fysbis), Windows service (JHUHUGIT).\n- **T1505.003** — Web shell (reGeorg on OWA).\n- **T1574.001** — DLL hijacking (Downdelph).\n\n### Privilege Escalation\n- **T1068** — Exploitation for privesc: CVE-2014-4076, CVE-2015-1701, CVE-2015-2387, CVE-2017-0263, and **CVE-2022-38028 (Print Spooler, via GooseEgg)**.\n- **T1548.002** — UAC bypass (Koadic, Downdelph).\n- **T1134.001 \u002F .005** — Token impersonation (CVE-2015-1701 → SYSTEM) and SID-History injection (Mimikatz).\n\n### Defense Evasion\n- **T1027 \u002F .002 \u002F .011 \u002F .013** — Obfuscation: base64\u002FXOR\u002FRC4, software packing (Zebrocy), fileless storage (CHOPSTICK), encrypted\u002Fencoded files.\n- **T1036 \u002F .005** — Masquerading: renamed WinRAR, file-extension and location spoofing.\n- **T1070.004 \u002F .006** — File deletion (CCleaner) and timestomping.\n- **T1112** — Registry modification (LoJax).\n- **T1218.005 \u002F .010 \u002F .011** — Mshta\u002FRegsvr32 (Koadic), Rundll32 (CHOPSTICK).\n- **T1553.004** — Install root certificate via certutil.\n- **T1564.001 \u002F .003 \u002F .004** — Hidden files, hidden PowerShell windows (`-WindowStyle Hidden`), NTFS attribute hiding (LoJax).\n- **T1497** — Sandbox\u002FVM evasion (CHOPSTICK).\n- **T1202** — Indirect command execution via Forfiles.\n\n### Credential Access\n- **T1110.001 \u002F .003** — Password guessing and **large-scale password spraying** (reconstituted spray infra, Tor\u002FVPN-fronted).\n- **T1557.001** — NBT-NS\u002FLLMNR poisoning (Responder).\n- **T1187 \u002F CVE-2023-23397** — **Forced NTLM authentication \u002F coercion** via crafted Outlook reminders to capture Net-NTLM hashes.\n- **T1003.001 \u002F .002 \u002F .003 \u002F .004 \u002F .006** — LSASS dump, SAM via `reg save`, NTDS via ntdsutil\u002FVSS, LSA secrets, DCSync (Mimikatz).\n- **T1555.003 \u002F .004** — Browser credential theft (XAgentOSX, Zebrocy, OLDBAIT), Windows Credential Manager.\n- **T1056.001** — Keylogging.\n- **T1528** — Steal application access tokens via OAuth apps masquerading as Google\u002FYahoo.\n- **T1098.002** — Add mailbox delegate \u002F ApplicationImpersonation permissions via PowerShell (Exchange).\n- **T1558.001 \u002F .002** — Golden\u002FSilver Kerberos tickets (Mimikatz).\n- **T1606** — Forge web credentials (phishing pages).\n- **T1552.001** — Credentials in files (XTunnel).\n\n### Discovery\n- **T1087.001 \u002F .002** — Local\u002Fdomain account enumeration (Net, LAMEHUG).\n- **T1083** — File\u002Fdirectory discovery (Forfiles for PDF\u002FOffice docs).\n- **T1046 \u002F T1135 \u002F T1018** — Network service, share, and remote-system discovery (Koadic, Net, Zebrocy).\n- **T1016 \u002F .002** — Network config and **Wi-Fi interface discovery** (for close-access ops).\n- **T1518.001** — Security software discovery (CHOPSTICK, netsh).\n- **T1482** — Domain trust discovery (LAMEHUG).\n- **T1201** — Password policy discovery (Net).\n- **T1082** — System information discovery (many families).\n\n### Lateral Movement\n- **T1021.001 \u002F .002 \u002F .004** — RDP, SMB\u002Fadmin shares, SSH (via reGeorg tunnel).\n- **T1550.002** — Pass-the-hash.\n- **T1210** — Exploitation of remote services (SMB RCE).\n\n### Collection\n- **T1114.002** — Remote email collection from Exchange\u002FOWA mailboxes.\n- **T1213.002** — Data from SharePoint repositories.\n- **T1005 \u002F T1039 \u002F T1025** — Local system, network-share, and removable-media collection.\n- **T1119** — Automated collection (publicly available tools on DCCC\u002FDNC; USBStealer; LAMEHUG).\n- **T1113** — Screen capture (Cannon, XAgentOSX, Zebrocy).\n- **T1056.001** — Keylogging for collection.\n- **T1602** — Data from network devices (Cisco router config via SNMP).\n- **T1560.001** — Archive via WinRAR (password-protected) \u002F PowerShell `Compress-Archive`.\n- **T1074.001 \u002F .002** — Local staging (e.g., `C:\\ProgramData`, `pi.log`) and remote staging on OWA server.\n\n### Command & Control\n- **T1071.001 \u002F .003** — Web (HTTP\u002FS) and mail protocols (IMAP\u002FPOP3\u002FSMTP via Google Mail) for C2.\n- **T1102.002** — Bidirectional C2 over Google Drive web service.\n- **T1568.002** — DGA (CHOPSTICK).\n- **T1008** — Fallback channels (CHOPSTICK, JHUHUGIT, XTunnel).\n- **T1090.001 \u002F .003** — Internal proxy (`netsh portproxy`) and multi-hop proxy (Tor\u002FVPN).\n- **T1572 \u002F T1095** — Protocol tunneling (reGeorg) and non-application-layer protocols (Drovorub).\n- **T1573.001 \u002F .002** — Symmetric and asymmetric encrypted channels.\n- **T1105** — Ingress tool transfer.\n\n### Exfiltration\n- **T1041** — Exfil over C2 channel.\n- **T1048.002** — Exfil over alternate protocol: HTTPS via compromised OWA server.\n- **T1567** — Exfil over web service (Google Drive).\n- **T1030** — Data transfer size limits (split archives into \u003C1MB chunks).\n- **T1052.001 \u002F T1020** — Automated USB exfiltration (USBStealer) for air-gap bridging.\n\n### Impact\n- **T1561.001** — Disk content wipe via `cipher.exe`.\n- **T1498** — Network DoS (2016 DDoS against WADA).\n\n## Signature tooling & malware\n\n| Name | ATT&CK ID | Type | Public\u002FCustom |\n|---|---|---|---|\n| CHOPSTICK \u002F X-Agent | S0023 | Modular Windows implant (DGA, fileless) | Custom |\n| JHUHUGIT \u002F Seduploader | S0044 | First-stage Windows implant | Custom |\n| ADVSTORESHELL | S0045 | Backdoor with custom archiving | Custom |\n| XTunnel | S0117 | Network proxy\u002Ftunnel | Custom |\n| CORESHELL \u002F Sofacy | S0137 | Windows downloader\u002Fbackdoor | Custom |\n| Downdelph | S0134 | Delphi backdoor + bootkit | Custom |\n| LoJax | S0397 | **UEFI rootkit** (firmware persistence) | Custom |\n| Drovorub | S0502 | Linux malware suite + kernel rootkit | Custom |\n| Fysbis | S0410 | Linux backdoor | Custom |\n| Komplex \u002F XAgentOSX | S0162 \u002F S0161 | macOS trojan \u002F implant | Custom |\n| X-Agent for Android | S0314 | Android surveillance | Custom |\n| Zebrocy | S0251 | Multi-stage downloader\u002Fcollector | Custom |\n| Cannon | S0351 | Backdoor with email-based exfil | Custom |\n| OLDBAIT | S0138 | Credential stealer | Custom |\n| USBStealer | S0136 | USB\u002Fair-gap exfil | Custom |\n| GooseEgg | (no ATT&CK software ID assigned) | Print Spooler privesc launcher (CVE-2022-38028) | Custom |\n| LAMEHUG | S9035 | LLM-assisted post-compromise implant | Custom |\n| reGeorg | S1187 | Web shell \u002F SOCKS tunnel | Public (Living-off-tooling) |\n| Koadic | S0250 | Post-exploitation framework | Public |\n| Mimikatz | S0002 | Credential dumping | Public |\n| Responder | S0174 | LLMNR\u002FNBT-NS poisoning | Public |\n| Tor | S0183 | Anonymity \u002F proxy | Public |\n| Net \u002F netsh \u002F certutil \u002F Wevtutil \u002F Forfiles | S0039 \u002F S0108 \u002F S0160 \u002F S0645 \u002F S0193 | LOLBins | Built-in |\n\n> Note: \"GooseEgg\" is a Microsoft-attributed custom tool; it is **not** the same as ATT&CK software S1145 (Pikabot), so no false software ID is assigned here.\n\n## Emulation guidance (Decepticon)\n\n> **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run destructive (T1561\u002FT1498) or firmware (LoJax-style) actions outside an explicitly sanctioned, isolated lab.\n\nMap APT28's signature plays to Decepticon's own capabilities:\n\n- **Initial access — credential ops (T1110.003, T1598.003, T1566.001).** Use the phishing\u002Fcredential-harvest skill to stand up lookalike webmail login pages; drive **slow, low-and-slow password spraying** (~few attempts\u002Faccount\u002Fhour) against in-scope OWA\u002FM365 endpoints, fronted through rotating egress to mimic Tor\u002FVPN spray infra. Stage macro\u002FRAR lures with the payload-builder; if WinRAR is in scope, emulate CVE-2023-38831 archive lures.\n- **NTLM coercion (T1187 \u002F CVE-2023-23397, T1557.001).** With the AD\u002Flateral-movement skill, run **Responder** for LLMNR\u002FNBT-NS poisoning and emulate Outlook-reminder NTLM coercion to capture Net-NTLM hashes, then relay or crack offline. This is APT28's defining 2023-2025 play — prioritize it.\n- **Privilege escalation (T1068, T1548.002).** Use the privesc\u002Fdefense-evasion skill to emulate **GooseEgg-style Print Spooler abuse (CVE-2022-38028)** for SYSTEM in a patched-vs-unpatched lab, and UAC bypass chains analogous to Koadic\u002FDowndelph.\n- **Credential access (T1003.*, T1558.*, T1550.002).** Drive the AD skill \u002F **Mimikatz** for LSASS dump, DCSync, golden\u002Fsilver tickets, and pass-the-hash — mirroring APT28's domain-takeover pattern.\n- **C2 (T1071.001, T1102.002, T1090, T1572).** Use **Sliver** (c2 skill) over HTTPS as the primary channel; add a **mail-protocol or Google-Drive web-service profile** to emulate Cannon\u002FDrive C2, and chain `netsh portproxy` internal proxies + reGeorg-style web-shell tunneling for pivoting.\n- **Cloud \u002F token theft (T1528, T1098.002, T1114.002, T1213.002).** With the cloud\u002FM365 skill, emulate OAuth-app consent abuse, ApplicationImpersonation\u002Fdelegate-permission grants, and bulk mailbox + SharePoint collection.\n- **Collection & exfil (T1560.001, T1030, T1048.002, T1567).** Use bash\u002FPowerShell to archive with password-protected RAR\u002F`Compress-Archive`, **split into \u003C1MB chunks**, and exfil over HTTPS through a compromised OWA-equivalent or a web service to reproduce the signature exfil pattern.\n- **Edge devices (T1602, T1133).** Where routers\u002FIP cameras are in scope, emulate SNMP\u002Fcredential weaknesses (cf. AA23-108) to recon network-device config — APT28 favors edge footholds.\n\n## Detection & defense\n\n- **NTLM coercion \u002F CVE-2023-23397:** Patch Outlook; block outbound SMB (TCP 445) and WebDAV at the perimeter; add high-value users to the **Protected Users** group; hunt for Exchange messages with `PidLidReminderFileParameter` UNC paths; alert on outbound NTLM to external hosts.\n- **Password spraying (T1110.003):** Enforce **phishing-resistant MFA**; alert on distributed low-rate auth failures across many accounts from rotating\u002FTor\u002FVPN IPs; disable legacy\u002Fbasic auth on M365\u002FOWA; monitor impossible-travel and new-ASN sign-ins.\n- **Print Spooler \u002F GooseEgg (CVE-2022-38028):** Apply Oct-2022+ patches; disable the Spooler where not needed; monitor for `spoolsv.exe` spawning cmd\u002FPowerShell and writes to Spooler driver\u002FJS-constraints paths.\n- **Credential dumping (T1003.*):** Enable LSA protection (RunAsPPL) and Credential Guard; alert on LSASS handle access, `ntdsutil`\u002F`vssadmin` shadow-copy creation, and `reg save` of SAM\u002FSYSTEM\u002FSECURITY; monitor DCSync replication from non-DC accounts.\n- **OAuth\u002Fdelegation abuse (T1528, T1098.002):** Audit enterprise app consent and mailbox `Add-MailboxPermission`\u002FApplicationImpersonation role grants; restrict user consent; review delegate\u002Fforwarding rules.\n- **Web shells & tunneling (T1505.003, T1572, T1090.001):** Monitor OWA\u002FIIS directories for new aspx\u002Fscript files (reGeorg); alert on `netsh interface portproxy add`; baseline web-server child processes.\n- **Persistence (T1547, T1137.002, T1542.003):** Monitor Run keys, `UserInitMprLogonScript`, Office Test registry keys; deploy Secure Boot + firmware integrity (against LoJax-class UEFI implants).\n- **Edge\u002Fnetwork devices (T1602):** Replace default SNMP community strings, restrict SNMP to management VLANs, patch Cisco IOS (cf. CVE-2017-6742), and monitor for unexpected config reads (Jaguar Tooth pattern).\n- **Exfiltration (T1030, T1048.002, T1567):** DLP\u002Fegress monitoring for chunked password-protected archives and uploads to Google Drive \u002F unusual HTTPS endpoints, especially staged from mail servers.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0007\u002F\n- https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa25-141a\n- https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa23-108\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F04\u002F22\u002Fanalyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials\u002F\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2023\u002F03\u002F24\u002Fguidance-for-investigating-attacks-using-cve-2023-23397\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Frussian-apt-fighting-ursa-exploits-cve-2023-233397\u002F\n- https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fus-charges-russian-gru-officers-international-hacking-and-related-influence-and\n- https:\u002F\u002Fwww.fbi.gov\u002Fnews\u002Fstories\u002Frussian-gru-officers-charged-with-hacking-100418\n- https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fnews\u002Fuk-enforces-new-sanctions-against-russia-for-cyber-attack-on-german-parliament\n- https:\u002F\u002Fwww.diplomatie.gouv.fr\u002Fen\u002Fcountry-files\u002Frussia\u002Fnews\u002F2025\u002Farticle\u002Frussia-attribution-of-cyber-attacks-on-france-to-the-russian-military\n- https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0397\u002F\n",{"name":5,"metadata":23,"description":7,"allowed-tools":28},{"tags":24,"subdomain":25,"when_to_use":26,"mitre_attack":27},"apt28, fancy-bear, forest-blizzard, sofacy, strontium, gru, russia, espionage, nation-state, g0007, adversary-emulation, mitre-attack","adversary-emulation","APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, STRONTIUM, Pawn Storm, GRU 26165, G0007, Russian GRU espionage emulation, NTLM relay \u002F CVE-2023-23397 Outlook, GooseEgg print spooler, password spraying, credential harvesting, NATO\u002FUkraine logistics targeting, election interference TTPs","T1583.001, T1583.003, T1583.006, T1586.002, T1595.002, T1589.001, T1591, T1598.003, T1566.001, T1204.001, T1204.002, T1669, T1190, T1189, T1203, T1210, T1221, T1133, T1199, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1047, T1204, T1569.002, T1547.001, T1037.001, T1137.002, T1546.015, T1542.003, T1547.004, T1547.005, T1547.006, T1547.013, T1543.001, T1543.002, T1543.003, T1505.003, T1574.001, T1548.002, T1068, T1134.001, T1134.005, T1027, T1027.002, T1027.011, T1027.013, T1036, T1036.005, T1070.004, T1070.006, T1112, T1218.005, T1218.010, T1218.011, T1553.004, T1564.001, T1564.003, T1564.004, T1497, T1202, T1003.001, T1003.002, T1003.003, T1003.004, T1003.006, T1110.001, T1110.003, T1555.003, T1555.004, T1056.001, T1557.001, T1557.004, T1040, T1528, T1552.001, T1098.002, T1558.001, T1558.002, T1606, T1087.001, T1087.002, T1083, T1046, T1135, T1518.001, T1018, T1082, T1016, T1016.002, T1482, T1201, T1021.001, T1021.002, T1021.004, T1550.002, T1119, T1005, T1039, T1025, T1113, T1114.002, T1213.002, T1560.001, T1074.001, T1074.002, T1071.001, T1071.003, T1090.001, T1090.003, T1102.002, T1105, T1573.001, T1573.002, T1568.002, T1008, T1095, T1572, T1041, T1048.002, T1567, T1052.001, T1020, T1030, T1561.001, T1498, T1602","Bash Read Write","main","376de63e2b186eeb9856476ae89186e62b1d3fbe","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt28-fancy-bear","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon","https:\u002F\u002Fgithub.com\u002Fdnzengou","2026-11-09 16:34:40",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add dnzengou\u002Fevo-decepticon --skill apt28-fancy-bear",{"tool":41,"command":42},"bunx","bunx skills add dnzengou\u002Fevo-decepticon --skill apt28-fancy-bear",{"tool":44,"command":45},"pnpm","pnpm dlx skills add dnzengou\u002Fevo-decepticon --skill apt28-fancy-bear","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt28-fancy-bear\u002FSKILL.md",true,[],[50,57,64,71,78,85],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":18},"01M78JAX15GZR5Q5S7RMPWFX43","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":18},"01M78JARXE0ZER8P81SFD024YP","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M78JANJNH8VMR0CK1Y6AM74G","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":18},"01M78JAFCYR2BAJF7KH0ZCXREA","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":18},"01M78JAAQ5T08FR9MY5SFNRWBM","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":18},"01M78JA6799JQZE0M9B21HRMGY","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]