APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.12 This group has been active since at least 2004.345678910111213 APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.14 In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.15 Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
- NSA/FBI Drovorub August 2020
- Cybersecurity Advisory GRU Brute Force Campaign July 2021
- DOJ GRU Indictment Jul 2018
- Ars Technica GRU indictment Jul 2018
- Crowdstrike DNC June 2016
- FireEye APT28
- SecureWorks TG-4127
- FireEye APT28 January 2017
- GRIZZLY STEPPE JAR
- Sofacy DealersChoice
- Palo Alto Sofacy 06-2018
- Symantec APT28 Oct 2018
- ESET Zebrocy May 2019
- Crowdstrike DNC June 2016
- US District Court Indictment GRU Oct 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1669 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.015 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1557.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1498 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1025 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1542.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1092 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1528 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1001.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1211 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1001.001 | Junk Data | — |
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1014 | Rootkit | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1025 | Data from Removable Media | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1030 | Data Transfer Size Limits | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037.001 | Logon Script (Windows) | — |
| T1039 | Data from Network Shared Drive | — |
| T1040 | Network Sniffing | — |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071.001 | Web Protocols | — |
| T1071.003 | Mail Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1090.002 | External Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1091 | Replication Through Removable Media | — |
| T1092 | Communication Through Removable Media | — |
| T1098.002 | Additional Email Delegate Permissions | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1110.001 | Password Guessing | — |
| T1110.003 | Password Spraying | — |
| T1113 | Screen Capture | — |
| T1114.002 | Remote Email Collection | — |
| T1119 | Automated Collection | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1134.001 | Token Impersonation/Theft | — |
| T1137.002 | Office Test | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1211 | Exploitation for Stealth | — |
| T1213 | Data from Information Repositories | — |
| T1213.002 | Sharepoint | — |
| T1218.011 | Rundll32 | — |
| T1221 | Template Injection | — |
| T1498 | Network Denial of Service | — |
| T1505.003 | Web Shell | — |
| T1528 | Steal Application Access Token | — |
| T1542.003 | Bootkit | — |
| T1546.015 | Component Object Model Hijacking | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.001 | Application Access Token | — |
| T1550.002 | Pass the Hash | — |
| T1557.004 | Evil Twin | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560 | Archive Collected Data | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1567 | Exfiltration Over Web Service | — |
| T1573.001 | Symmetric Cryptography | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1583.006 | Web Services | — |
| T1584.008 | Network Devices | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1588.007 | Artificial Intelligence | — |
| T1589.001 | Credentials | — |
| T1591 | Gather Victim Org Information | — |
| T1595.002 | Vulnerability Scanning | — |
| T1596 | Search Open Technical Databases | — |
| T1598 | Phishing for Information | — |
| T1598.003 | Spearphishing Link | — |
| T1669 | Wi-Fi Networks | — |
| T1684.001 | Impersonation | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
APT28 · Fancy Bear · Forest Blizzard · FROZENLAKE · Group 74 · GruesomeLarch · IRON TWILIGHT · Pawn Storm · Sednit · SNAKEMACKEREL · Sofacy · STRONTIUM · Swallowtail · TG-4127 · Threat Group-4127 · Tsar Team · 奇幻熊
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.