APT28
Also known as: Fancy Bear, Sofacy, Sednit, STRONTIUM, Forest Blizzard, Pawn Storm
APT28 is one of the most documented state espionage groups. It mixes large-scale credential attacks (password spraying and phishing) with exploitation of internet-facing systems and network devices, and has run close-access Wi-Fi operations near targets. Its operations have repeatedly been tied to Russian foreign-policy priorities, from elections to the war in Ukraine.
- Public attribution
- Publicly attributed by the US and UK governments to Russia's military intelligence service (GRU), 85th Main Special Service Center, military unit 26165.
- Active since
- Around 2004
- Targets
- Governments and militaries in Europe, NATO and the US
- Political parties and election-related organisations
- Defence, logistics and technology firms supporting Ukraine
- International sporting and anti-doping bodies
Notable campaigns
2016US election-related intrusions
Compromise of the Democratic National Committee and Democratic Congressional Campaign Committee networks; a 2018 US indictment charged GRU officers over the activity.
2014-2018Anti-doping and OPCW operations
A 2018 US indictment covered operations against WADA, USADA and the Organisation for the Prohibition of Chemical Weapons, including close-access Wi-Fi operations.
2021Cisco router exploitation
UK and US agencies reported the group using SNMP access and CVE-2017-6742 to deploy the Jaguar Tooth malware on poorly maintained Cisco routers.
2022 onwardTargeting of Ukraine aid logistics
A 2025 joint advisory described a campaign against Western logistics and technology companies involved in delivering assistance to Ukraine, linked to wide-scale targeting of IP cameras in the region.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1110.003Brute Force: Password Spraying
- T1190Exploit Public-Facing Application
- T1203Exploitation for Client Execution
- T1003.001OS Credential Dumping: LSASS Memory
- T1090.003Proxy: Multi-hop Proxy
- T1557.004Adversary-in-the-Middle: Evil Twin
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Phishing-resistant MFA (FIDO2 or certificate-based) on email, VPN and cloud accounts, so sprayed or phished passwords are not enough.
- Detect password spraying: alert on many accounts failing from one source and on successful logons after failures.
- Patch or retire internet-facing mail servers, VPNs and routers quickly; disable SNMP v1/v2c and unused management services on network devices.
- Protect LSASS (Credential Guard, LSA protection) and limit local administrator rights to slow credential dumping.
- Use WPA2/WPA3-Enterprise with server certificate validation so devices refuse evil-twin access points.