APT28
APT28 is a state-sponsored advanced persistent threat group widely attributed in the content to Russia’s GRU military intelligence service. It is also tracked as Fancy Bear, Sofacy, Sednit, STRONTIUM, Pawn Storm, and Forest Blizzard. The content describes APT28 as conducting long-term cyber-espionage operations aligned with Russian strategic interests, particularly against political, military, diplomatic, government, and defense-related targets. Reported targeting in the content includes the 2016 Democratic National Committee breach, Emmanuel Macron’s 2017 presidential campaign, NATO’s Joint Air Power Competence Centre, the German Bundestag, TV5Monde, the World Anti-Doping Agency, the OSCE, Ukraine’s Ministry of Defence, U.S. nuclear facilities, and cybersecurity firms. The content also notes spearphishing against Ukrainian targets, including emails impersonating Ukrainian government officials. Tradecraft directly described in the content includes spear-phishing, credential theft and credential dumping, password spraying against government and defense sectors, deployment of custom malware such as X-Agent, persistence, lateral movement, remote command-and-control activity, and use of malicious Microsoft Office attachments in spear-phishing emails. The content also references a Linux XAgent variant. In specific operations, APT28 is described as using spear-phishing to lure victims into clicking malicious links or opening attachments, harvesting credentials for broader access, deploying X-Agent for remote command execution and file transfer, and moving laterally to reach critical systems. The content also attributes LoJax to APT28, describing it as the first known real-world UEFI malware attack, and states that Russia’s GRU-linked APT28 group used compromised Ubiquiti routers as an espionage relay in a separate operation. The aliases list in the source is noisy and includes names commonly associated with other actors; only the aliases directly supported by the content for this actor are included above.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
69 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
49 malware families attributed to this actor across reporting.
44 additional families tracked in Mallory.
Associated vulnerabilities
35 CVEs this actor has used in observed campaigns. 35 of them exploited in the wild.
Patching CVE-2026–21509 is necessary, but not sufficient. Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication)
These attacks began with a phishing email, purporting to be from Ukraine's hydro-meteorological center, that contained a weaponized LNK file to exploit another vulnerability, CVE-2026-21513. By chaining CVE-2026-21513 with CVE-2026-21510, the Russian spies bypassed Microsoft security features including Defender SmartScreen and remotely executed malicious code on victims' computers.
CVE-2026-21510 — Windows Shell Protection Mechanism Failure In two separate campaigns observed by Proofpoint in March and April 2026, DPRK-aligned threat actor TA406 (Opal Sleet) chained CVE-2026-21509 and CVE-2026-21510 within a single attack sequence... invoked CVE-2026-21510 to bypass Windows Shell security controls and execute a DLL payload.
Leveraging a network scan we ran in February 2022, we found the server 45.138.87[.]250 / ceriossl[.]info... mentioned in a Qianxin blogpost describing a campaign abusing CVE-2023-23397 that attributed it to Sednit.
GooseEgg weaponises CVE-2022-38028 in the Windows Print Spooler service to obtain SYSTEM-level execution.
30 more CVEs tied to this actor tracked in Mallory.
Observables
398 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used HTML smuggling to deliver Cobalt Strike beacons in campaigns against European governments.
Turned compromised Ubiquiti routers into an espionage relay network to mask operations.
Referenced as a separate Russian threat group detected on the DNC network during the 2016 investigation.
Created and used the LoJax UEFI malware in a real-world firmware-targeting attack, repurposing LoJack anti-theft software to infect UEFI firmware remotely.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.