Loading story…
Google Threat Intelligence published a report detailing the cyber-espionage operations of APT28, the Russia-linked threat group also tracked as Fancy Bear. The report describes how the group has conducted long-running intelligence collection campaigns aligned with Russian state interests, targeting governments, military organizations, defense sectors, media, and other high-value entities. The activity is presented as a window into how a mature state-backed actor selects victims, sustains access, and supports broader geopolitical objectives through cyber operations.
The report highlights APT28 as a persistent espionage actor known for credential theft, phishing, malware deployment, and post-compromise tradecraft designed to collect sensitive information from targeted networks. By outlining the group’s operational patterns and targeting behavior, Google’s analysis gives defenders updated context on a prominent Russian intrusion set and reinforces the need for stronger monitoring of phishing activity, account compromise, and unauthorized access across organizations exposed to nation-state threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant published a report detailing malware and tradecraft associated with **APT28**, the Russia-linked cyber-espionage group also widely tracked as **Fancy Bear**. The report describes the intrusion set as part of broader Russian intelligence collection activity, highlighting how the group uses Windows-based malware and operational techniques to gain access, maintain persistence, and support espionage objectives against targeted organizations. The publication provides defenders with a technical window into APT28 operations by mapping malware usage and intrusion behavior tied to Russian state-aligned campaigns. The report adds to public intelligence on the group’s tooling and methods, giving security teams updated context for threat hunting, detection engineering, and prioritizing monitoring for activity associated with APT28.
Jun 29, 2026
APT28, also tracked as **Sofacy**, **Fancy Bear**, **Sednit**, and **Strontium**, conducted sustained cyber-espionage operations against political, government, telecommunications, aerospace, and Ukraine-linked targets using spear phishing, typosquatted sites, exploit delivery, and custom malware. Reporting tied the group to campaigns that deployed first-stage downloaders, backdoors, credential-dumping tools, exfiltration modules, and the **Seduploader** malware family, including a macro-enabled Word lure themed around a cybersecurity conference that executed `rundll32.exe` to install persistence and enable screenshot capture, file download, code execution, and data theft. Separate analysis also documented **Fysbis**, a Linux backdoor linked to Sofacy infrastructure, showing the group’s cross-platform capability and continued use of modular implants for covert access. Defenders and platform operators responded with both technical guidance and infrastructure disruption. The UK’s NCSC published indicators of compromise and detection guidance for APT28 malware including **X-Tunnel**, **X-Agent**, and **CompuTrace**, while Microsoft said it obtained a court order to seize seven domains used by the group and redirect them to a sinkhole after the infrastructure was used to target Ukrainian institutions as well as U.S. and EU government and think-tank networks for persistent access and exfiltration. Across the referenced reporting, APT28’s operations were characterized by curated targeting, evolving malware variants, and repeated use of attacker-controlled domains and command-and-control systems to support intelligence collection.
Aug 15, 2026
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026