APT / StateG0007

APT28

Also known as: APT-C-20, ATK5, Blue Athena, BlueDelta, FANCY BEAR, FROZENLAKE and 24 more

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Similar names and other brands

The name “GRIZZLY STEPPE” is also used for APT29. GRIZZLY STEPPE is the US government's name for Russian intelligence services' activity as a whole; it covers APT28 and APT29, which are distinct groups. [source 1] [source 2]

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity92

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 93

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials Gather Victim Org Information Vulnerability Scanning Search Open Technical Databases Phishing for Information Spearphishing Link

Resource development

Domains Virtual Private Server Web Services Network Devices Email Accounts Tool Artificial Intelligence

Initial access

Drive-by Compromise Exploit Public-Facing Application Trusted Relationship Spearphishing Attachment Wi-Fi Networks

Execution

PowerShell Windows Command Shell Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistence

Logon Script (Windows)Additional Email Delegate Permissions External Remote Services Office Test Web Shell Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation Component Object Model Hijacking

Credential access

OS Credential Dumping LSASS Memory NTDS Network Sniffing Brute Force Password Guessing Password Spraying Steal Application Access Token Evil Twin

Discovery

Process Discovery File and Directory Discovery Peripheral Device Discovery

Lateral movement

SMB/Windows Admin Shares Replication Through Removable Media Exploitation of Remote Services Application Access Token Pass the Hash

Collection

Data from Local System Data from Removable Media Data from Network Shared Drive Keylogging Local Data Staging Remote Data Staging Screen Capture Remote Email Collection Automated Collection Data from Information Repositories Sharepoint Archive Collected Data Archive via Utility

Command and control

Junk Data Web Protocols Mail Protocols External Proxy Multi-hop Proxy Communication Through Removable Media Bidirectional Communication Ingress Tool Transfer Symmetric Cryptography

Exfiltration

Data Transfer Size Limits Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration Over Web Service

Impact

Network Denial of Service

defense-impairment

Clear Windows Event Logs

stealth

Rootkit Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location File Deletion Timestomp Valid Accounts Cloud Accounts Token Impersonation/Theft Deobfuscate/Decode Files or Information Exploitation for Stealth Rundll32 Template Injection Bootkit Hidden Files and Directories Hidden Window Impersonation

Exploited vulnerabilities 10

CVEs this group is known to exploit, with the source and confidence of each next to it. Ordered by confidence and real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2017-0262HIGHEPSS 81%KEV MITRE ATT&CK

CVE-2015-1701HIGHEPSS 56%KEV MITRE ATT&CK

CVE-2015-2387HIGHEPSS 35%KEV MITRE ATT&CK

CVE-2022-38028HIGHEPSS 15%KEV MITRE ATT&CK

CVE-2015-4902MEDIUMEPSS 14%KEV MITRE ATT&CK

CVE-2017-0263HIGHEPSS 10%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

CVE-2014-4076EPSS 23% MITRE ATT&CK

References

APT28 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →