APT28

APT28 is a Russian state-sponsored cyber espionage and information operations threat actor widely attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), specifically Unit 26165. It is one of the most extensively tracked Russian intrusion sets and is commonly associated with long-running espionage, credential theft, influence operations, and selective disruptive activity in support of Russian strategic and military objectives. APT28 is widely known under numerous aliases, including Fancy Bear, Sofacy, Sednit, STRONTIUM, Forest Blizzard, Pawn Storm, BlueDelta, Fighting Ursa, Iron Twilight, Swallowtail, Tsar Team, UAC-0001, and UAC-0028. Some reporting has used Forest Blizzard as the primary Microsoft designation for this actor. The alias set in circulation is noisy and sometimes conflated with other Russian actors; high-confidence attribution consistently centers on APT28, Fancy Bear, Sednit, Sofacy, STRONTIUM, and GRU Unit 26165. The group primarily targets government, military, defense-industrial, diplomatic, political, media, telecommunications, energy, and critical infrastructure entities, with a sustained emphasis on Ukraine, NATO member states, Europe, and North America. It has also targeted anti-doping organizations, international institutions, and election-related entities. Its operations are typically aligned with intelligence collection requirements, battlefield or geopolitical priorities, and broader Russian influence objectives. APT28 is known for combining traditional cyber espionage with active measures. Its operations have included spearphishing, credential harvesting, exploitation of public-facing applications and edge devices, malware deployment, abuse of valid accounts, adversary-in-the-middle collection, false personas, hack-and-leak activity, and amplification of stolen material for political or reputational effect. Public reporting has linked the group to campaigns involving theft of emails and documents, manipulated or selective disclosures, and covert support to information operations. Observed tradecraft includes phishing attachments and links, webmail and collaboration-platform exploitation, credential and session-token theft, DNS manipulation on small office and home office routers, and use of compromised edge infrastructure to intercept authentication flows. The actor has also been associated with exploitation of routers and network devices to gain footholds, support adversary-in-the-middle operations, and harvest credentials from remote workers and other targets using unmanaged or weakly managed network infrastructure. APT28 has historically used a broad malware ecosystem. Families and tooling associated with the group include X-Agent, X-Tunnel, Zebrocy, and more recent tooling such as PixyNetLoader and LameHug. Reported capabilities include persistence through COM hijacking or scheduled execution, stealthy payload delivery, tunneling, cloud-based command and control, steganographic configuration or payload concealment, and document collection. Zebrocy has long been treated as a notable malware family associated with the actor, although malware overlap alone is not sufficient for attribution in every case. The group has also been observed adopting contemporary delivery and evasion methods, including use of legitimate services and cloud platforms for command and control, living-off-the-land execution chains, and social-engineering techniques such as ClickFix-style user-assisted execution. Reporting further indicates use of utilities such as mshta and regsvr32 for proxy execution and staged payload delivery. APT28 is best understood as a GRU espionage actor that also supports broader Russian hybrid operations. In contrast to actors focused purely on long-term clandestine collection, APT28 has repeatedly demonstrated willingness to operationalize stolen information, create deceptive personas, and integrate cyber intrusion with influence and reputational attacks. This combination of espionage, credential theft, malware-enabled access, and information operations remains a defining characteristic of the group.