APT28
APT28 is a Russian state-sponsored intrusion set publicly attributed to the GRU’s Unit 26165 and widely tracked under aliases including Fancy Bear, Forest Blizzard, Sofacy, Sednit, Pawn Storm, Strontium, Fighting Ursa, BlueDelta, UAC-0001, and UAC-0028. The group has conducted cyber espionage, credential theft, and influence or hack-and-leak operations for roughly two decades, primarily targeting government, defense, diplomatic, military, critical infrastructure, logistics, transportation, and policy organizations, with a strong focus on NATO member states, Ukraine, Europe, and the United States. The content describes APT28 as one of the most prolific and persistent GRU-linked actors. Reported historic operations include the 2015 German Bundestag intrusion, the TV5Monde sabotage operation conducted under the fake CyberCaliphate persona, the 2016 intrusions into the DCCC, DNC, and Hillary Clinton campaign, and the leak of stolen World Anti-Doping Agency athlete medical records during the 2016 Rio Olympics. The group also used fake personas under the DC Leaks banner to seed stolen information to journalists. APT28 has used spear phishing, exploit delivery, credential harvesting, webmail theft, and edge-device compromise. The content states it exploited CVE-2023-23397 to harvest Net-NTLMv2 hashes from European government, military, energy, and transportation targets, and weaponized CVE-2026-21509 within 24 hours of disclosure in a January 2026 espionage campaign against European military, government, maritime, and transport organizations. That campaign used malicious Office documents with embedded OLE objects and WebDAV-delivered payloads, first-stage loaders including SimpleLoader or SimpleDropper, COM hijacking persistence, and either a steganography-based loader that extracted an in-memory Covenant Grunt implant from PNG files or an Outlook VBA backdoor called NotDoor for long-term mailbox collection and forwarding. The group’s malware and tooling in the content include Seduploader, X-Agent, X-Tunnel, Sedreco, Zebrocy, GooseEgg, HeadLace, CredoMap, MASEPIE, OCEANMAP, STEELHOOK, BeardShell, Slimagent, LameHug, PixyNetLoader, Jaguar Tooth, Covenant/Covenant Grunt, and NotDoor. PixyNetLoader is described as a DLL-based loader active since late 2024 that hides encrypted payloads in PNG image files using steganography and executes a Covenant Grunt implant in memory, with command and control via the FILEN cloud service. ESET reported APT28 using BeardShell and Covenant since April 2024 for long-term surveillance of Ukrainian military personnel, drone manufacturers, and drone research and development organizations, while also targeting logistics and transportation companies outside Ukraine. The content also highlights APT28’s infrastructure shift from rented VPS systems to compromised SOHO and edge devices, including Ubiquiti EdgeRouters, MikroTik, TP-Link, and older Cisco IOS routers. Reported operations include use of a MooBot-based router botnet later disrupted by the FBI’s Operation Dying Ember, the FrostArmada campaign that rewrote DNS settings for adversary-in-the-middle credential and OAuth token theft, and deployment of the custom Cisco IOS malware Jaguar Tooth via CVE-2017-6742 after identifying weak SNMP community strings. The group has also abused legitimate cloud services such as Koofr, Icedrive, and Filen for covert command and control. Victimology in the content includes Ukrainian government and defense targets, Ukrainian military personnel, European foreign ministries, law enforcement, maritime and transport organizations, democratic think tanks, intelligence targets, international sporting organizations, and Western or NATO-country logistics providers, tech companies, and government organizations supporting Ukraine. The content also notes use of targeted lure material for credential harvesting and modules that notify operators when USB mass storage devices are inserted. APT28 is additionally described as using PowerShell, staging captured credentials in files such as pi.log and in C:\ProgramData, and deploying malware that copied itself to the Startup directory for persistence.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Military
- Utilities
- Transportation
- Software & Services
- Academia & Research
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
- 🇺🇸 United States
- 🇩🇪 Germany
- 🇫🇷 France
- 🇵🇱 Poland
- 🇧🇬 Bulgaria
- 🇷🇴 Romania
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
66 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
49 malware families attributed to this actor across reporting.
44 additional families tracked in Mallory.
Associated vulnerabilities
29 CVEs this actor has used in observed campaigns. 29 of them exploited in the wild.
PixyNetLoader is a DLL-based malware loader. It arrives via a malicious Office document that exploits CVE-2026-21509.
These attacks began with a phishing email, purporting to be from Ukraine's hydro-meteorological center, that contained a weaponized LNK file to exploit another vulnerability, CVE-2026-21513. By chaining CVE-2026-21513 with CVE-2026-21510, the Russian spies bypassed Microsoft security features including Defender SmartScreen and remotely executed malicious code on victims' computers.
CVE-2026-21510 — Windows Shell Protection Mechanism Failure In two separate campaigns observed by Proofpoint in March and April 2026, DPRK-aligned threat actor TA406 (Opal Sleet) chained CVE-2026-21509 and CVE-2026-21510 within a single attack sequence... invoked CVE-2026-21510 to bypass Windows Shell security controls and execute a DLL payload.
The FBI on Tuesday warned that Russia's GRU, via Fancy Bear, has been exploiting routers to steal credentials from organizations worldwide. The agency singled out TP-Link routers compromised via CVE-2023-50224.
APT28 weaponised the zero-click flaw CVE-2023-23397, patched by Microsoft in March 2023 after a CERT-UA report. In-the-wild exploitation ran from April to December 2022 against European government, military, energy and transportation targets.
24 more CVEs tied to this actor tracked in Mallory.
Observables
359 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Long-running espionage-focused threat actor shifting from traditional VPS infrastructure to compromised SOHO routers, consumer devices, and legitimate cloud services for covert command-and-control, phishing, credential theft, and stealthier cyber operations.
Long-running Russian military intelligence espionage and influence actor targeting government, defense, diplomatic, critical infrastructure, civil society, and military entities. The content describes evolution from X-Agent/X-Tunnel-era intrusions and hack-and-leak operations to credential harvesting, Outlook zero-click exploitation, compromised edge-router infrastructure, webmail exploitation, modular implants, and newer cloud-backed and LLM-assisted malware operations focused heavily on Ukraine, NATO members, and Europe.
Uses targeted lure material to harvest credentials from intelligence targets; World Cup-related lures could be used for phishing emails, fake login portals, malicious attachments, or impersonation of legitimate event-related services.
Linked to PixyNetLoader campaigns that hide payloads in PNG files using steganography, deliver via malicious Office documents exploiting CVE-2026-21509, establish COM persistence, extract and execute Covenant Grunt in memory, and use the FILEN cloud service for command and control. Exatrack also identified APT28 tools SlimAgent and Graphite through shared binary packaging characteristics.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.