Skip to content

APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the…

ATT&CK ID: G0007
Origin: Russia
Weather family: Blizzard
Techniques: 73
Tools: 29

Also tracked as IRON TWILIGHT · SNAKEMACKEREL · Swallowtail · Group 74 · Sednit · Sofacy · Pawn Storm · Fancy Bear · STRONTIUM · Tsar Team · Threat Group-4127 · TG-4127 · Forest Blizzard · FROZENLAKE · GruesomeLarch

Vulnerabilities it has exploited

Techniques

Reconnaissance

Gather Victim Identity Information Gather Victim Org Information Active Scanning Search Open Technical Databases Phishing for Information

Resource Development

Acquire Infrastructure Compromise Infrastructure Compromise Accounts Obtain Capabilities

Initial Access

Valid Accounts Replication Through Removable Media External Remote Services Drive-by Compromise Exploit Public-Facing Application Trusted Relationship Phishing Wi-Fi Networks

Execution

Command and Scripting Interpreter Exploitation for Client Execution User Execution Inter-Process Communication

Persistence

Boot or Logon Initialization Scripts Valid Accounts Account Manipulation External Remote Services Office Application Startup Server Software Component Pre-OS Boot Event Triggered Execution Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Initialization Scripts Exploitation for Privilege Escalation Valid Accounts Account Manipulation Access Token Manipulation Event Triggered Execution Boot or Logon Autostart Execution

Stealth

Rootkit Obfuscated Files or Information Masquerading Indicator Removal Valid Accounts Access Token Manipulation Deobfuscate/Decode Files or Information Exploitation for Stealth System Binary Proxy Execution Template Injection Pre-OS Boot Hide Artifacts Social Engineering

Defense Impairment

Disable or Modify Tools

Credential Access

OS Credential Dumping Network Sniffing Input Capture Brute Force Steal Application Access Token Adversary-in-the-Middle

Discovery

Network Sniffing Process Discovery File and Directory Discovery Peripheral Device Discovery

Lateral Movement

Remote Services Replication Through Removable Media Exploitation of Remote Services Use Alternate Authentication Material

Collection

Data from Local System Data from Removable Media Data from Network Shared Drive Input Capture Data Staged Screen Capture Email Collection Automated Collection Data from Information Repositories Adversary-in-the-Middle Archive Collected Data

Command and Control

Data Obfuscation Application Layer Protocol Proxy Communication Through Removable Media Web Service Ingress Tool Transfer Encrypted Channel

Exfiltration

Data Transfer Size Limits Exfiltration Over Alternative Protocol Exfiltration Over Web Service

Impact

Network Denial of Service

Software

ADVSTORESHELL · CHOPSTICK · CORESHELL · Cannon · DealersChoice · Downdelph · Drovorub · Forfiles · Fysbis · HIDEDRV · JHUHUGIT · Koadic · Komplex · LAMEHUG · LoJax · Mimikatz · Net · OLDBAIT · Responder · Tor · USBStealer · Wevtutil · Winexe · XAgentOSX · XTunnel · Zebrocy · certutil · cipher.exe · reGeorg

MITRE ATT&CK All threat actors