MITRE ATT&CKcampaign

C0051 APT28 Nearest Neighbor Campaign

Published 2025-02-25 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2025-02-25

Description

APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (20)

  • T1686.003 Windows Host Firewall sub-technique
  • S1205 cipher.exe software (tool)
  • T1669 Wi-Fi Networks technique
  • T1016.002 Wi-Fi Discovery sub-technique
  • T1584 Compromise Infrastructure technique
  • T1090.001 Internal Proxy sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1560.001 Archive via Utility sub-technique
  • T1561.001 Disk Content Wipe sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1003.003 NTDS sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • S0108 netsh software (tool)
  • T1006 Direct Volume Access technique

References