AI-SEARCH-apt28 medium

Description

AI-discovered findings for topic: 'APT28'. Run at 2026-10-29T15:07:11.834113Z. DuckDuckGo returned 10 result(s); the AI Forensic Validator classified 0 IOC(s) as valid. CVEs mentioned: CVE-2026-21509

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (41)

• APT28 (Fancy Bear) — Nation-State Threat Actor | Russia

  APT28 is a Russian military intelligence (GRU Unit 26165) cyber espionage group active since at least 2004. They are among the most prolific nation-state actors globally, known for aggressive targeting of democratic institutions, military organizations, and critical infrastructure. The group uniquely combines technical exploitation with influence operations — stealing data then weaponizing ...

• Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and ...

  Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. The activity has been attributed to APT28 (aka BlueDelta), which was tied to a "sustained" credential ...

• APT28 — Latest News, Reports & Analysis | The Hacker News

  APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday Mar 02, 2026 Vulnerability / Threat Intelligence

• Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys ...

  The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under ...

• APT28 (Fancy Bear): Operations, Malware & Attacks

  APT28 is an advanced persistent threat group attributed to the Russian General Staff Main Intelligence Directorate (GRU), specifically its 85th Main Special Service Center, Military Unit 26165. It has been operating since at least 2004, making it one of the longest-running state hacking groups on record, cataloged by MITRE ATT&CK as G0007.

• Fancy Bear - Wikipedia

  The report designated the group as "Advanced Persistent Threat 28" ( APT28 ) and described how the hacking group used zero-day exploits of the Microsoft Windows operating system and Adobe Flash. [18] The report found operational details indicating that the source is a "government sponsor based in Moscow".

• Apt28 — Threat Actor Profile, Campaigns & Targets

  Apt28 threat actor profile: known campaigns, targets, tooling and recent activity across 50 threat clusters.

• APT28 (Fancy Bear) - Welcome

  Overview of APT28 APT28 (also known as Fancy Bear, Sofacy, Sednit, BlueDelta, Forest Blizzard and other aliases) is a long‑running Russian advanced persistent threat (APT) group. Multiple governments and cybersecurity organisations attribute APT28 to the Main Intelligence Directorate (GRU) of Russia (specifically Military Unit 26165).

• PDF APT28 exploits known vulnerability to carry out reconnaissance and ...

  APT28 exploits known vulnerability to carry out reconnaissance of routers and deploy malware APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742.

• PDF APT28 exploits known vulnerability to carry out reconnaissance and ...

  We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165. APT28 (also known as Fancy Bear, STRONTIUM, Pawn Storm, the Sednit Gang and Sofacy) is a highly skilled threat actor.

• APT28 - Cyber Kill Chain

  APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.

• Fancy Bear (APT28) Threat Actor Profile: TTPs, IOCs & Attacks | Huntress

  Fancy Bear, also known as APT28 , is a Russian state-sponsored cyber espionage group active since at least 2004. This group represents a highly-skilled Advanced Persistent Threat (APT) actor, consistently linked to the Main Intelligence Directorate of the Russian Federation (GRU). Fancy Bear is known for its use of zero-day vulnerabilities, spear-phishing campaigns, and sophisticated malware in ...

• Sofacy AKA APT28: Threat Actor Profile - Cyble

  Threat Actor Profile: APT28 (Fancy Bear) Cyble showcases its findings on APT28 , AKA Fancy Bear, a notorious APT group, and the tactics, targets, tools, and techniques it uses in its cyber espionage activities.

• APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor ...

  1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU's 85th Main Special Service Center (GTsSS), military unit 26165, active since at least 2004. (attack.mitre.org) The group is assessed by multiple governments to conduct both intelligence collection and "hack-and-leak" influence activity, with sustained targeting of ...

• APT Groups Tracker 2026: Active Nation-State Threat Actors

  Mandiant / Google Threat Intelligence : Uses the APT numbering system ( APT28 , APT29, APT41, etc.) and UNC designations for uncategorized groups. Mandiant's annual M-Trends report is essential reading for understanding year-over-year trends in nation-state activity.

• APT28, an evolution of tradecraft - sekoia.com

  Context Sekoia's Threat Detection & Research (TDR) team has been tracking APT28 for several years. The intrusion set, also known as Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm or Sednit and publicly attributed to the GRU's Unit 26165, is one of the most prolific and persistent state-sponsored actors we monitor. Its operations span in two decades and consistently target government ...

• APT28: Russia's Persistent Cyber Espionage Arm - Brandefense

  Introduction APT28 , also known as Fancy Bear, Sofacy, Sednit, STRONTIUM, and various other epithets, is the most recognizable and longstanding advanced persistent threat (APT) group still in existence. APT28 is the tip of the spear of Russian state-affiliated cyber capabilities. APT28 has been traced back as far as 2004, and the group has been assessed with high confidence by national ...

• APT28 | Threat Actor Profiles

  Overview APT28 (also tracked as Fancy Bear, Forest Blizzard, STRONTIUM, Pawn Storm, Sednit, and Sofacy) is a Russian military intelligence (GRU) cyber espionage group attributed to Unit 26165 of the 85th Main Special Service Center (GTsSS). Active since at least 2004, APT28 conducts intelligence collection aligned with Russian military and geopolitical objectives. The group is known for ...

• PDF APT28: A Window into Russia s Cyber Espionage Operations? | FireEye

  The activity that we profile in this paper appears to be the work of a skilled team of developers and operators collecting intelligence on defense and geopolitical issues - intelligence that would only be useful to a government. We believe that this is an advanced persistent threat (APT) group engaged in espionage against political and military targets including the country of Georgia ...

• APT28: Inside Russia's Fancy Bear Military Intelligence Hacking Unit

  When cybersecurity professionals discuss the most aggressive and destructive nation-state threat actors, APT28 inevitably dominates the conversation. Known by numerous aliases including Fancy Bear, Sofacy, Sednit, and Pawn Storm, this Russian military intelligence hacking unit has conducted some of the most brazen and consequential cyberattacks in history. From disrupting democratic elections ...

• Top 10 Advanced Persistent Threat (APT) Groups in 2026

  What Are Advanced Persistent Threat (APT) Groups? Advanced Persistent Threat (APT) groups represent highly strategic cyber actors focused on long-term infiltration rather than quick attacks. Such groups slip into networks quietly and remain active for extended periods to gather intelligence or prepare disruption.

• APT28 Archives - SecurityWeek

  US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking The APT28 threat group exploited vulnerable TP-Link and MikroTik routers to conduct adversary-in-the-middle (AitM) attacks.

• APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware ...

  APT28 exploited a Microsoft Office flaw to deliver MiniDoor and Covenant Grunt malware in targeted attacks across Ukraine and Eastern Europe.

• APT28 Weaponizes Outlook Zero-Click Flaw to Steal Net-NTLMv2 Hashes ...

  Russian state-sponsored threat actor APT28 , also known as Fancy Bear or Forest Blizzard, has aggressively shifted its cyber espionage tactics to focus on zero-click vulnerabilities and edge infrastructure. Recent threat intelligence reveals that the group, publicly attributed to the GRU's Unit 26165, has weaponized a critical Outlook flaw to silently extract Net-NTLMv2 hashes from NATO ...

• APT28 Malware | Russia's Cyber Espionage Operations Report | Google ...

  This report focuses on a threat group that we have designated as APT28 . While APT28's malware is fairly well known in the cybersecurity community, our report details additional information exposing ongoing, focused operations that we believe indicate a government sponsor based in Moscow.

• threat-intelligence-reports/reports/2026-06-apt28-military ... - GitHub

  I assess APT28 as a relevant public-source case study for espionage and military or political intelligence collection. This report focuses on observable behavior, confidence, victimology, and defensive implications rather than unsourced attribution claims. I prioritize ATT&CK-mapped behavior and source-based observables over stale atomic ...

• APT28's Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and ...

  Attribution to APT28 This campaign is attributed to APT28 with high confidence based on technical indicators and victimology. CERT-UA officially attributed the January 2026 attacks to threat actor UAC-0001 [1], which corresponds to APT28 (Fancy Bear), a unit of Russia's GRU military intelligence .

• PDF APT28 exploit routers to enable DNS hijacking operations

  For more information on APT28 activity, see the advisories 'Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure', 'APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on cisco routers' and 'UK and allies expose Russian intelligence campaign targeting western logistics and ...

• CVE-2026-32202 IOCs, Detection Rules & APT28 TTPs: Complete…

  CVE-2026-32202: APT28 Zero-Click NTLM Credential Theft, IOCs and Detection Reference Sources: Microsoft Security Response Center, CVE-2026-32202 Advisory | Microsoft Threat Intelligence , APT28 Active Exploitation | CISA Known Exploited Vulnerabilities Catalog | SigmaHQ Detection Rules Repository

• A Shortcut to Coercion: Incomplete Patch of APT28's Zero-Day Leads to ...

  Akamai researchers reveal how an incomplete patch for APT28's zero-day led to CVE-2026-32202, a zero-click vulnerability enabling NTLM authentication coercion.

• PDF Alert: I-260407-PSA | 07 APRIL 2026 Russian GRU Exploiting Vulnerable ...

  GRU Exploiting Vulnerable Routers to Steal Sensitive Information Russian General Staff Main Intelligence Directorate (GRU) cyber actors are exploiting vulnerable routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information. The U.S. Department of Justice and the FBI recently disrupted a GRU network of compromised small-office home-office ...

• APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor ...

  1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU's 85th Main Special Service Center (GTsSS), military unit 26165, active since at least 2004. (attack.mitre.org) The group is assessed by multiple governments to conduct both intelligence collection and "hack-and-leak" influence activity, with sustained targeting of ...

• PDF APT28 ADVANCED PERS - eurepoc.eu

  State-integrated hacking group: Based on the reports about the group's alleged political affiliations and several indictments against GRU agents, which claim to identify APT28 members, the group is considered a de facto agent of the Russian state, more specifically its military intelligence branch (GRU). Furthermore, its extensive operations against defence ministries, NATO installations ...

• APT28 Intelligence Dashboard Immediately Available for ThreatConnect

  Centralized Intelligence : Compiles APT28 -specific indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs) from open-source intelligence , threat feeds, and internal telemetry. Real-Time Threat Tracking: Offers continuous updates on APT28's attack infrastructure, victimology trends, and newly observed techniques.

• APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and ...

  We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165 . APT28 (also known as Fancy Bear, STRONTIUM, Pawn Storm, the Sednit Gang and Sofacy) is a highly skilled threat actor. Download the UK PDF version of this report:

• PDF APT28 exploits known vulnerability to carry out reconnaissance and ...

  APT28 exploits known vulnerability to carry out reconnaissance of routers and deploy malware APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742.

• Russian State-Linked APT28 Exploits SOHO Routers in Global DNS ...

  The Microsoft Threat Intelligence team, in its analysis of the campaign, attributed the activity to APT28 and its sub-group tracked as Storm-2754. The tech giant said it identified more than 200 organizations and 5,000 consumer devices impacted by the threat actor's malicious DNS infrastructure.

• APT28 exploit routers to enable DNS hijacking operations

  For more information on APT28 activity, see the advisories ' Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure ', ' APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on cisco routers ' and ' UK and allies expose Russian intelligence campaign targeting western logistics and ...

• APT28 Cyber Threat Profile and Detailed TTPs

  Explore APT28's history, major campaigns, and MITRE ATT&CK TTPs. Learn how to simulate and defend against this threat with Picus.

• APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit ...

  APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.

• APT28 / Fancy Bear: Russian State Sponsored APT - Threat Actors

  Overview APT28 , also known as Fancy Bear, is a sophisticated and prolific advanced persistent threat (APT) group strongly linked to the Russian Main Intelligence Directorate (GRU).

• First Known LLM-Powered Malware From APT28 Hackers Integrates AI ...
  web:cybersecuritynews.com

  APT28 fuses LLM into live malware via Hugging Face API, delivering dynamic shell commands through phishing PDF ZIP decoys.

  2026-05-26 13:00 UTC
• LAMEHUG: APT28's First AI-Powered Malware Explained | Guardsix
  web:guardsix.com

  Threat actors may exploit public LLM APIs to generate malicious code, obfuscate payloads, or automate reconnaissance—much like APT28 did with LameHug. Additionally, risks such as prompt injection, data leakage, or the use of unvetted open-source models in internal systems can introduce new attack vectors.

  2026-05-26 13:00 UTC
• Next-Gen Threat: Google Exposes AI-Enabled Malware That Rewrites Its ...
  web:securityonline.info

  Google exposed AI -enabled malware like PROMPTFLUX, which uses the Gemini API to dynamically rewrite its own source code to evade detection. APT28 was seen deploying an LLM-assisted stealer.

  2026-05-26 13:00 UTC
• APT28 Router Exploitation Campaign 2026: GRU DNS Hijacking, AitM ...
  web:sourcedev.tr

  In April 2026, a joint advisory from the NSA, FBI, and partners across 15+ NATO-aligned nations confirmed that APT28 — the GRU-linked threat actor also tracked as Fancy Bear and Forest Blizzard — had compromised thousands of SOHO routers worldwide. By exploiting a known authentication flaw in TP-Link and MikroTik devices, the group modified DNS and DHCP settings to redirect traffic through ...

  2026-05-26 13:00 UTC
• Russian APT28 Behavior, LLM/AI Use, and Strategic Foresight
  web:treadstone71.substack.com

  The sharing and collation of these indicators will be instrumental in the early detection of AI -crafted attacks. In conclusion, AI is poised to become both a formidable weapon and an essential shield in cyberspace. APT28's venture into LLM-assisted hacking is likely the vanguard of a broader trend, with other threat actors rapidly following suit.

  2026-05-26 13:00 UTC
• Triage Security: Defending global infrastructure against APT28 ...
  web:triagesecurity.ai

  Recent intelligence details sustained campaigns by the APT28 threat actor targeting government, defense, and critical infrastructure networks. By understanding their use of specific vulnerabilities and router-based DNS redirection, security teams can implement targeted, foundational defenses to protect sensitive data.

  2026-05-26 13:00 UTC
• APT28's Toolkit: AI, Wi-Fi Intrusions, Cloud C2 - eSecurity Planet
  web:www.esecurityplanet.com

  APT28's new "LameHug" malware uses LLMs to generate basic commands, a strikingly clumsy move from an otherwise advanced threat group.

  2026-05-26 13:00 UTC
• Internet Crime Complaint Center (IC3) | Russian GRU Exploiting ...
  web:www.ic3.gov

  Understanding the DNS Hijacking Operations Since at least 2024, Russian GRU 85th Main Special Service Center (85th GTsSS) cyber actors — also known as APT28 , Fancy Bear, and Forest Blizzard — have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224. The GRU actors changed the devices' dynamic host ...

  2026-05-26 13:00 UTC
• APT28 Cyber Threat Profile and Detailed TTPs
  web:www.picussecurity.com

  Explore APT28's history, major campaigns, and MITRE ATT&CK TTPs. Learn how to simulate and defend against this threat with Picus.

  2026-05-26 13:00 UTC
• APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor ...
  web:www.threatintelreport.com

  APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor Profile By Threat Analyst 20 February 2026 Cybercrime_Organizations, Incident_Response, Malware_Detection, Nation_State_Actors, Threat_Hunting

  2026-05-26 13:00 UTC

Only Available for Registered Users. Sign in to view.