APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.12 This group has been active since at least 2004.345678910111213 APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.14 In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.15 Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
- NSA/FBI Drovorub August 2020
- Cybersecurity Advisory GRU Brute Force Campaign July 2021
- DOJ GRU Indictment Jul 2018
- Ars Technica GRU indictment Jul 2018
- Crowdstrike DNC June 2016
- FireEye APT28
- SecureWorks TG-4127
- FireEye APT28 January 2017
- GRIZZLY STEPPE JAR
- Sofacy DealersChoice
- Palo Alto Sofacy 06-2018
- Symantec APT28 Oct 2018
- ESET Zebrocy May 2019
- Crowdstrike DNC June 2016
- US District Court Indictment GRU Oct 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1669 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.015 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1557.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1498 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1025 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1542.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1092 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1528 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1001.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1211 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1001.001 | Junk Data | — |
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1014 | Rootkit | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1025 | Data from Removable Media | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1030 | Data Transfer Size Limits | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037.001 | Logon Script (Windows) | — |
| T1039 | Data from Network Shared Drive | — |
| T1040 | Network Sniffing | — |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071.001 | Web Protocols | — |
| T1071.003 | Mail Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1090.002 | External Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1091 | Replication Through Removable Media | — |
| T1092 | Communication Through Removable Media | — |
| T1098.002 | Additional Email Delegate Permissions | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1110.001 | Password Guessing | — |
| T1110.003 | Password Spraying | — |
| T1113 | Screen Capture | — |
| T1114.002 | Remote Email Collection | — |
| T1119 | Automated Collection | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1134.001 | Token Impersonation/Theft | — |
| T1137.002 | Office Test | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1211 | Exploitation for Stealth | — |
| T1213 | Data from Information Repositories | — |
| T1213.002 | Sharepoint | — |
| T1218.011 | Rundll32 | — |
| T1221 | Template Injection | — |
| T1498 | Network Denial of Service | — |
| T1505.003 | Web Shell | — |
| T1528 | Steal Application Access Token | — |
| T1542.003 | Bootkit | — |
| T1546.015 | Component Object Model Hijacking | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.001 | Application Access Token | — |
| T1550.002 | Pass the Hash | — |
| T1557.004 | Evil Twin | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560 | Archive Collected Data | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1567 | Exfiltration Over Web Service | — |
| T1573.001 | Symmetric Cryptography | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1583.006 | Web Services | — |
| T1584.008 | Network Devices | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1588.007 | Artificial Intelligence | — |
| T1589.001 | Credentials | — |
| T1591 | Gather Victim Org Information | — |
| T1595.002 | Vulnerability Scanning | — |
| T1596 | Search Open Technical Databases | — |
| T1598 | Phishing for Information | — |
| T1598.003 | Spearphishing Link | — |
| T1669 | Wi-Fi Networks | — |
| T1684.001 | Impersonation | — |
| T1685.005 | Clear Windows Event Logs | — |
别名
APT28 · Fancy Bear · Forest Blizzard · FROZENLAKE · Group 74 · GruesomeLarch · IRON TWILIGHT · Pawn Storm · Sednit · SNAKEMACKEREL · Sofacy · STRONTIUM · Swallowtail · TG-4127 · Threat Group-4127 · Tsar Team · 奇幻熊
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。