MITRE ATT&CKgroup

G0007 APT28

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise, mobile
Aliases
IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch
Version
5.3
Created
2017-05-31

Description

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Related

Uses · MITRE ATT&CK (123)

  • S9035 LAMEHUG software (malware)
  • T1684.001 Impersonation sub-technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • S1205 cipher.exe software (tool)
  • T1669 Wi-Fi Networks technique
  • S1187 reGeorg software (malware)
  • T1557.004 Evil Twin sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1584.008 Network Devices sub-technique
  • T1588.007 Artificial Intelligence sub-technique
  • S0645 Wevtutil software (tool)
  • T1589.001 Credentials sub-technique
  • T1591 Gather Victim Org Information technique
  • T1595.002 Vulnerability Scanning sub-technique
  • T1596 Search Open Technical Databases technique
  • T1598 Phishing for Information technique
  • T1598.003 Spearphishing Link sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1583.006 Web Services sub-technique
  • T1586.002 Email Accounts sub-technique
  • T1588.002 Tool sub-technique
  • T1583.001 Domains sub-technique
  • S0502 Drovorub software (malware)
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.001 Junk Data sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1090.002 External Proxy sub-technique
Show all 123 ›

Referenced by MITRE ATT&CK · attributed to (1)

  • C0051 APT28 Nearest Neighbor Campaign campaign

References