APT28

Origin🇷🇺 Rússia

Techniques (MITRE ATT&CK)93

SourceMITRE ATT&CK

State sponsor: Russian FederationAttribution confidence: 50%Target categories: Government, Military

Targeted regions: Georgia · France · Jordan · United States · Hungary · World Anti-Doping Agency · Armenia · Tajikistan · Japan · NATO +15

Also known as:IRON TWILIGHTSNAKEMACKERELSwallowtailGroup 74SednitSofacyPawn StormFancy BearSTRONTIUMTsar TeamThreat Group-4127TG-4127Forest BlizzardFROZENLAKEGruesomeLarch

Vexday analysis

APT28 é um grupo de ameaça persistente avançada atribuído à Unidade Militar 26165 do Centro Principal de Serviços Especiais (GTsSS) do GRU, serviço de inteligência militar russo, com atividade documentada desde pelo menos 2004. O grupo é conhecido por ter comprometido a campanha de Hillary Clinton, o Comitê Nacional Democrata (DNC) e o Comitê de Campanha do Congresso Democrata (DCCC) em 2016, em uma operação de interferência nas eleições presidenciais norte-americanas; em 2018, cinco oficiais da Unidade 26165 associados ao grupo foram indiciados nos Estados Unidos por operações cibernéticas conduzidas entre 2014 e 2018. Rastreado pelo MITRE ATT&CK sob o identificador G0007 e também conhecido pelos aliases Sednit, Sofacy, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail e Group 74, o grupo possui 93 técnicas documentadas na base ATT&CK e 10 CVEs a ele atribuídas.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity92

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 93

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials Gather Victim Org Information Vulnerability Scanning Search Open Technical Databases Phishing for Information Spearphishing Link

Resource development

Domains Virtual Private Server Web Services Network Devices Email Accounts Tool Artificial Intelligence

Initial access

Drive-by Compromise Exploit Public-Facing Application Trusted Relationship Spearphishing Attachment Wi-Fi Networks

Execution

PowerShell Windows Command Shell Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistence

Logon Script (Windows)Additional Email Delegate Permissions External Remote Services Office Test Web Shell Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation Component Object Model Hijacking

Credential access

OS Credential Dumping LSASS Memory NTDS Network Sniffing Brute Force Password Guessing Password Spraying Steal Application Access Token Evil Twin

Discovery

Process Discovery File and Directory Discovery Peripheral Device Discovery

Lateral movement

SMB/Windows Admin Shares Replication Through Removable Media Exploitation of Remote Services Application Access Token Pass the Hash

Collection

Data from Local System Data from Removable Media Data from Network Shared Drive Keylogging Local Data Staging Remote Data Staging Screen Capture Remote Email Collection Automated Collection Data from Information Repositories Sharepoint Archive Collected Data Archive via Utility

Command and control

Junk Data Web Protocols Mail Protocols External Proxy Multi-hop Proxy Communication Through Removable Media Bidirectional Communication Ingress Tool Transfer Symmetric Cryptography

Exfiltration

Data Transfer Size Limits Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration Over Web Service

Impact

Network Denial of Service

defense-impairment

Clear Windows Event Logs

stealth

Rootkit Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location File Deletion Timestomp Valid Accounts Cloud Accounts Token Impersonation/Theft Deobfuscate/Decode Files or Information Exploitation for Stealth Rundll32 Template Injection Bootkit Hidden Files and Directories Hidden Window Impersonation

Exploited vulnerabilities 10

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2017-0262HIGHEPSS 81%KEV CVE-2015-1701HIGHEPSS 56%KEV CVE-2015-2387HIGHEPSS 35%KEV CVE-2022-38028HIGHEPSS 15%KEV CVE-2015-4902MEDIUMEPSS 13%KEV CVE-2017-0263HIGHEPSS 10%KEV CVE-2016-6662EPSS 68%CVE-2017-0176EPSS 46%CVE-2014-4076EPSS 23%

References

APT28 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →