frozenlake
APT28 is a Russian state-sponsored cyber espionage group, attributed to the GRU's Unit 26165. Active since at least 2004, APT28 is known for targeting government, military, defense, and critical infrastructure organizations, particularly in Ukraine, Eastern Europe, the EU, and NATO member states, but also in Africa and South America. The group is highly adaptive, leveraging zero-day and n-day vulnerabilities, especially in webmail platforms such as Roundcube, Zimbra, Horde, and MDaemon, to conduct credential theft, data exfiltration, and persistent access operations. Notable campaigns include Operation RoundPress, which exploited XSS vulnerabilities in webmail servers via spear-phishing emails containing malicious JavaScript payloads. APT28 has also deployed advanced malware such as PROMPTSTEAL (LAMEHUG), which uses LLMs for dynamic command generation, and the BeardShell backdoor, which employs steganography and cloud-based C2. The group has a history of exploiting vulnerabilities in Cisco IOS XE, MDaemon, and other enterprise platforms. APT28 is also known for using AI-driven malware and for evolving its TTPs to evade detection, including the use of cloud services for C2 and the integration of LLMs for real-time code mutation. The group is responsible for high-profile incidents such as the 2016 DNC hack, attacks on WADA, and ongoing campaigns against Ukrainian and EU defense sectors. Known aliases include Fancy Bear, Sednit, Sofacy, Forest Blizzard, and BlueDelta.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT28 is deploying AI-enabled malware (PROMPTSTEAL) that leverages LLMs in live operations to generate commands for data harvesting and exfiltration, marking a shift to AI-assisted cyber espionage.
APT28 is leveraging AI-powered malware, specifically PROMPTSTEAL, to dynamically generate and execute system and file collection commands during live operations, enabling adaptive data exfiltration and evasion.
APT28 is conducting data-mining operations using AI-powered malware (PromptSteal) that leverages LLMs to generate commands dynamically during attacks. The malware is being used against Ukraine and is being actively developed to improve obfuscation and command-and-control methods.
APT28 has been observed leveraging LLM-enabled malware in campaigns such as LameHug and PROMPTSTEAL, embedding Large Language Model capabilities directly into malicious payloads to generate code at runtime and evade traditional detection methods.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.