apt28-fancy-bear

• SKILL.mdcore · 21,421 bytes

# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile

APT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.

## Attribution & motivation

- **Sponsor / nation:** Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include **influence / information operations** (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional **destructive / disruptive** action (TV5Monde disruption, WADA DDoS).
- **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI/MFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).

## Targeting

- **Sectors:** Government and diplomatic bodies; defense, military, and aerospace; **logistics, transport, and IT/technology firms supporting aid to Ukraine** (since 2022); think tanks, NGOs, and political organizations/campaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.
- **Regions:** NATO and allied states — heavy focus on Ukraine, Western/Eastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.