APT28
High ConfidenceCritical ThreatFancy Bear • Sofacy • Pawn Storm • Sednit • STRONTIUM • Forest Blizzard +2 more
APT28, also known as Fancy Bear, Sofacy, and Forest Blizzard, is a highly skilled and persistent cyber espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU). Active since at least 2004, the group is known for its sophisticated and well-resourced operations targeting governments, militaries, and security organizations worldwide. APT28's activities are closely aligned with Russian strategic interests, focusing on intelligence gathering, and the group has been linked to numerous high-profile attacks, including interference in the 2016 U.S. presidential election. The group's operations are characterized by a combination of technical sophistication and a deep understanding of their targets' networks and vulnerabilities. They are known for their use of zero-day exploits, custom malware, and a wide range of tactics, techniques, and procedures (TTPs) to achieve their objectives. APT28's ability to adapt and evolve its methods over time makes it a persistent and formidable threat in the cyber landscape.
APT28, also known as Fancy Bear, Sofacy, and Forest Blizzard, is a highly skilled and persistent cyber espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU). Active since at least 2004, the group is known for its sophisticated and well-resourced operations targeting governments, militaries, and security organizations worldwide. APT28's activities are closely aligned with Russian strategic interests, focusing on intelligence gathering, and the group has been linked to numerous high-profile attacks, including interference in the 2016 U.S. presidential election. The group's operations are characterized by a combination of technical sophistication and a deep understanding of their targets' networks and vulnerabilities. They are known for their use of zero-day exploits, custom malware, and a wide range of tactics, techniques, and procedures (TTPs) to achieve their objectives. APT28's ability to adapt and evolve its methods over time makes it a persistent and formidable threat in the cyber landscape.
Target Sectors
Target Regions
Attributed to GRU Unit 26165 (Russia). Attribution confidence: High.
Future Outlook
APT28 is expected to continue operations targeting Government sectors.
First observed activity of APT28
Continued active operations