APT28Threat actor
- apt-c-20
- atk5
- blue athena
- bluedelta
- Fancy Bear
- fighting ursa
- forest blizzard
- frozenlake
- g0007
- group 74
- gruesomelarch
- iron twilight
- itg05
- lake relic
- pawn storm
- Sednit
- sig40
- snakemackerel
- sofacy
- strontium
- Swallowtail
- t-apt-12
- ta422
- tg-4127
- threat group-4127
- tsar team
- UAC-0001
- uac-0028
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.From MISP Galaxy
Last reported yesterday, by SecurityWeek40 reports
ATT&CK techniques
6 of 77 · each with the sentence it comes from- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1053.005Scheduled Task
“The 2024 samples combined a Windows Registry Run key value with a scheduled task, while a July 2025 version relied on Run key entries.”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
- T1056.001Keylogging
“T1056.001”
- T1071.001Web Protocols
“T1071.001”
- T1005Data from Local System
“T1005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
40 reports · the newest 20, newest first · the exact sentence from each-
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware“APT28 aims Hookedge backdoor at NATO shipbuilder, engine maker”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“Swallowtail (APT28, Fancy Bear, Forest Blizzard): Good ol' APT28 targeted a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines in NATO countries.”
-
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign“…of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU.”
-
Incomplete security patches show hackers where to look next“Microsoft patched CVE-2026-21510, a Windows Shell vulnerability the APT28 group was exploiting in the wild, in February 2026.”
-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader“Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader”
-
Defense contractors in two NATO allies hacked in recent Russia-linked campaign“The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.”
-
Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)““The other two were CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, which was a fix for an incomplete patch for CVE-2026-21510.”
-
Attackers Hijack Three ccTLDs to Obtain Google Certificates“Read more on DNS hijacking: US Thwarts DNS Hijacking Network Controlled by Russian APT28 Hackers”
-
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware“Read more on Russian state hacking in Ukraine: Fancy Bear Exploits Microsoft Office Flaw in Ukraine, EU Cyber-Attacks”
-
August 2026 Threat Trend Report on APT Groups“APT28 (BlueDelta) used HOOKEDGE and webhook.Site to carry out spear phishing and data exfiltration.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“The FBI seized a version of the botnet in 2024 that was being used by APT28, a cyber unit inside Russia's military intelligence agency.”
-
July 2026 Threat Trend Report on APT Groups“APT28 executed a remote access Trojan using Filen.Io as a C2 channel via document- and file-based techniques.”
-
Hotel Wi-Fi Routers Compromised to Steal Corporate Login Credentials From Visitors“…ers noted that the tradecraft used in the DNS poisoning campaign, which is still ongoing, is similar to previous campaigns attributed to APT28, also known as Fancy Bear and Forest Blizzard, a cyber espionage group linked to the Russian military intelligence agency (GRU).”
-
Sednit recargado: un APT histórico reactiva su arsenal“Sednit recargado: un APT histórico reactiva su arsenal”
-
"Бюлетень небезпеки": UAC-0001 (APT28) здійснює кібератаки у відношенні України та країн ЄС з використанням експлойту CVE-2026-21509 (CERT-UA#19542)“"Бюлетень небезпеки": UAC-0001 (APT28) здійснює кібератаки у відношенні України та країн ЄС з використанням експлойту CVE-2026-21509 (CERT-UA#19542)”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“As highlighted in the High-Tech Crime Trends Report 2025, APT28 also used this tactic against the Ukrainian government, as reported by the Ukrainian CERT.”
-
Bleak outlook: Mitigating CVE-2023-23397“…f we use the above IP address to build a network graph with Group-IB’s proprietary Graph Network Analysis tool, it reveals the link with APT28 – the only group that has been exploiting the vulnerability since last year.”
-
“We find many things that others do not even see”“Analysing the activities of advanced groups like APT28 and Dark Halo is much more difficult.”
-
RDoS attacks by fake Fancy Bear hit banks in multiple locations“RDoS attacks by fake Fancy Bear hit banks in multiple locations”
-
Silence: Moving into the Darkside“The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28.”
Indicators in its reports
named in the reports above- infosec[.]exchangein 2 reports
- d0db619a7a160949…151bf9775c32in 1 report
- 99b454262dc26b08…82a49d334e5ein 1 report
- 5603e99151f8803c…4d071542f01bin 1 report
- 6d39f49aa11ce057…9bae423ce3d5in 1 report
- hxxps://getyourpages[.]com/downloads/brv%E2%80%9Din 1 report
- getyourpages[.]comin 1 report
- hxxps://getyourpages[.]com/downloads/bravo.zipin 1 report
- police-am[.]infoin 1 report
- hxxps://finalstepgo[.]com/uploads/il2.txtin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.