Threat feed IOCs (29)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT28. Each row shows why it was linked and where it came from.

Public research & publications (73)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• welivesecurity.comhttp://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf
• arstechnica.comhttps://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/
• attack.mitre.orghttps://attack.mitre.org/groups/G0007
• blog.talosintelligence.comhttps://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html
• media.defense.govhttps://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
• msrc-blog.microsoft.comhttps://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/
• researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/
• researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
• securelist.comhttps://securelist.com/a-slice-of-2017-sofacy-activity/83930/
• securelist.comhttps://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
• accenture.comhttps://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50
• crowdstrike.comhttps://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
• fireeye.comhttps://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
• justice.govhttps://www.justice.gov/file/1080281/download
• justice.govhttps://www.justice.gov/opa/page/file/1098481/download
• microsoft.comhttps://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/
• secureworks.comhttps://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign
• symantec.comhttps://www.symantec.com/blogs/election-security/apt28-espionage-military-government
• us-cert.govhttps://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf
• welivesecurity.comhttps://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/
• www2.fireeye.comhttps://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf
• attack.mitre.orghttps://attack.mitre.org/groups/G0007/
• en.wikipedia.orghttps://en.wikipedia.org/wiki/Fancy_Bear
• en.wikipedia.orghttps://en.wikipedia.org/wiki/Sofacy_Group
• bbc.comhttps://www.bbc.com/news/technology-37590375
• bbc.co.ukhttps://www.bbc.co.uk/news/technology-45257081
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/apt-28
• apnews.comhttps://www.apnews.com/4d174e45ef5843a0ba82e804f080988f
• voanews.comhttps://www.voanews.com/a/iaaf-hack-fancy-bears/3793874.html
• dw.comhttps://www.dw.com/en/hackers-lurking-parliamentarians-told/a-19564630
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
• www2.fireeye.comhttps://www2.fireeye.com/rs/848-DID-242/images/wp-mandiant-matryoshka-mining.pdf
• eff.orghttps://www.eff.org/deeplinks/2015/08/new-spear-phishing-campaign-pretends-be-eff
• aptnotes.malwareconfig.comhttps://aptnotes.malwareconfig.com/web/viewer.html?file=../APTnotes/2014/apt28.pdf
• accenture.comhttps://www.accenture.com/us-en/blogs/blogs-snakemackerel-delivers-zekapab-malware
• wired.comhttps://www.wired.com/story/russian-fancy-bears-hackers-release-apparent-ioc-emails/
• symantec-blogs.broadcom.comhttps://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-sofacy-attacks-multiple-government-entities/
• msn.comhttps://www.msn.com/en-nz/news/world/russian-hackers-accused-of-targeting-un-chemical-weapons-watchdog-mh17-files/ar-BBNV2ny
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-new-sofacy-attacks-against-us-government-agency/
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/
• welivesecurity.comhttps://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
• bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/apt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild/
• blog.trendmicro.comhttps://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-targets-mh17-investigation-team/
• researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/
• trendmicro.comhttps://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf
• blog.trendmicro.comhttps://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
• blogs.microsoft.comhttps://blogs.microsoft.com/on-the-issues/2018/08/20/we-are-taking-new-steps-against-broadening-threats-to-democracy/
• lse.co.ukhttps://www.lse.co.uk/AllNews.asp?code=kwdwehme&headline=Russian_Hackers_Suspected_In_Cyberattack_On_German_Parliament
• volkskrant.nlhttps://www.volkskrant.nl/cultuur-media/russen-faalden-bij-hackpogingen-ambtenaren-op-nederlandse-ministeries~b77ff391/
• ibtimes.co.ukhttps://www.ibtimes.co.uk/russian-hackers-fancy-bear-likely-breached-olympic-drug-testing-agency-dnc-experts-say-1577508
• bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/
• justice.govhttps://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected
• accenture.comhttps://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf
• reuters.comhttps://www.reuters.com/article/us-sweden-doping/swedish-sports-body-says-anti-doping-unit-hit-by-hacking-attack-idUSKCN1IG2GN
• researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/
• netzpolitik.orghttps://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
• washingtonpost.comhttps://www.washingtonpost.com/technology/2019/02/20/microsoft-says-it-has-found-another-russian-operation-targeting-prominent-think-tanks/?utm_term=.870ff11468ae
• handelsblatt.comhttps://www.handelsblatt.com/today/politics/election-risks-russia-linked-hackers-target-german-political-foundations/23569188.html?ticket=ST-2696734-GRHgtQukDIEXeSOwksXO-ap1
• accenture.comhttps://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf
• marcoramilli.comhttps://marcoramilli.com/2019/12/05/apt28-attacks-evolution/
• bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-nato-training-docs-to-breach-govt-networks/
• quointelligence.euhttps://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/fighting-ursa/
• blog.googlehttps://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
• blog.googlehttps://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
• bsi.bund.dehttps://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
• bluepurple.binaryfirefly.comhttps://bluepurple.binaryfirefly.com/p/bluepurple-pulse-week-ending-june-64e
• volexity.comhttps://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/