APT28

{
  "id": "ATTACK:enterprise:G0007",
  "title": "APT28",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0007",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c",
  "external_id": "G0007",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:48.664Z",
  "modified": "2026-07-31T20:48:44.067Z",
  "version": "5.3",
  "aliases": [
    "APT28",
    "IRON TWILIGHT",
    "SNAKEMACKEREL",
    "Swallowtail",
    "Group 74",
    "Sednit",
    "Sofacy",
    "Pawn Storm",
    "Fancy Bear",
    "STRONTIUM",
    "Tsar Team",
    "Threat Group-4127",
    "TG-4127",
    "Forest Blizzard",
    "FROZENLAKE",
    "GruesomeLarch"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SNAKEMACKEREL"
    },
    {
      "source_name": "Fancy Bear"
    },
    {
      "source_name": "Tsar Team"
    },
    {
      "source_name": "APT28"
    },
    {
      "source_name": "STRONTIUM"
    },
    {
      "source_name": "FROZENLAKE"
    },
    {
      "source_name": "Forest Blizzard"
    },
    {
      "source_name": "GruesomeLarch"
    },
    {
      "source_name": "IRON TWILIGHT"
    },
    {
      "source_name": "Threat Group-4127"
    },
    {
      "source_name": "TG-4127"
    },
    {
      "source_name": "Pawn Storm"
    },
    {
      "source_name": "Swallowtail"
    },
    {
      "source_name": "Group 74"
    },
    {
      "source_name": "Accenture SNAKEMACKEREL Nov 2018",
      "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
    },
    {
      "source_name": "Crowdstrike DNC June 2016",
      "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
    },
    {
      "source_name": "Leonard TAG 2023",
      "url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
    },
    {
      "source_name": "US District Court Indictment GRU Oct 2018",
      "url": "https://www.justice.gov/opa/page/file/1098481/download"
    },
    {
      "source_name": "GRIZZLY STEPPE JAR",
      "url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
    },
    {
      "source_name": "ESET Zebrocy May 2019",
      "url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"
    },
    {
      "source_name": "ESET Sednit Part 3",
      "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"
    },
    {
      "source_name": "Sofacy DealersChoice",
      "url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/"
    },
    {
      "source_name": "FireEye APT28 January 2017",
      "url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
    },
    {
      "source_name": "FireEye APT28",
      "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
    },
    {
      "source_name": "Ars Technica GRU indictment Jul 2018",
      "url": "https://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/"
    },
    {
      "source_name": "TrendMicro Pawn Storm Dec 2020",
      "url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"
    },
    {
      "source_name": "Securelist Sofacy Feb 2018",
      "url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"
    },
    {
      "source_name": "Kaspersky Sofacy",
      "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
    },
    {
      "source_name": "Nearest Neighbor Volexity",
      "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
    },
    {
      "source_name": "Palo Alto Sofacy 06-2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
    },
    {
      "source_name": "Talos Seduploader Oct 2017",
      "url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020",
      "url": "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/"
    },
    {
      "source_name": "Microsoft STRONTIUM Aug 2019",
      "url": "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/"
    },
    {
      "source_name": "DOJ GRU Indictment Jul 2018",
      "url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
    },
    {
      "source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
      "url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
    },
    {
      "source_name": "NSA/FBI Drovorub August 2020",
      "url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"
    },
    {
      "source_name": "SecureWorks TG-4127",
      "url": "https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign"
    },
    {
      "source_name": "Secureworks IRON TWILIGHT Active Measures March 2017",
      "url": "https://www.secureworks.com/research/iron-twilight-supports-active-measures"
    },
    {
      "source_name": "Secureworks IRON TWILIGHT Profile",
      "url": "https://www.secureworks.com/research/threat-profiles/iron-twilight"
    },
    {
      "source_name": "Symantec APT28 Oct 2018",
      "url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"
    },
    {
      "source_name": "Sednit"
    },
    {
      "source_name": "Sofacy"
    }
  ]
}