Loading story…
Mandiant published a report detailing malware and tradecraft associated with APT28, the Russia-linked cyber-espionage group also widely tracked as Fancy Bear. The report describes the intrusion set as part of broader Russian intelligence collection activity, highlighting how the group uses Windows-based malware and operational techniques to gain access, maintain persistence, and support espionage objectives against targeted organizations.
The publication provides defenders with a technical window into APT28 operations by mapping malware usage and intrusion behavior tied to Russian state-aligned campaigns. The report adds to public intelligence on the group’s tooling and methods, giving security teams updated context for threat hunting, detection engineering, and prioritizing monitoring for activity associated with APT28.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
According to Sekoia, APT28 moved away from rented VPS infrastructure to compromised SOHO routers and consumer edge devices, while also abusing legitimate cloud services for covert command-and-control. The report says this infrastructure peaked in December 2025 at more than 18,000 unique IP addresses across 120 countries, affecting about 200 organizations and 5,000 consumer devices.
Google Cloud's Mandiant published a blog report titled "APT28 Malware | Russia's Cyber Espionage Operations Report," providing analysis of APT28 and its malware in the context of Russian cyber espionage activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.sekoia.io
Open sourcemandiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence published a report detailing the cyber-espionage operations of **APT28**, the Russia-linked threat group also tracked as **Fancy Bear**. The report describes how the group has conducted long-running intelligence collection campaigns aligned with Russian state interests, targeting governments, military organizations, defense sectors, media, and other high-value entities. The activity is presented as a window into how a mature state-backed actor selects victims, sustains access, and supports broader geopolitical objectives through cyber operations. The report highlights APT28 as a persistent espionage actor known for credential theft, phishing, malware deployment, and post-compromise tradecraft designed to collect sensitive information from targeted networks. By outlining the group’s operational patterns and targeting behavior, Google’s analysis gives defenders updated context on a prominent Russian intrusion set and reinforces the need for stronger monitoring of phishing activity, account compromise, and unauthorized access across organizations exposed to nation-state threats.
Jul 12, 2026
APT28, also tracked as **Sofacy**, **Fancy Bear**, **Sednit**, and **Strontium**, conducted sustained cyber-espionage operations against political, government, telecommunications, aerospace, and Ukraine-linked targets using spear phishing, typosquatted sites, exploit delivery, and custom malware. Reporting tied the group to campaigns that deployed first-stage downloaders, backdoors, credential-dumping tools, exfiltration modules, and the **Seduploader** malware family, including a macro-enabled Word lure themed around a cybersecurity conference that executed `rundll32.exe` to install persistence and enable screenshot capture, file download, code execution, and data theft. Separate analysis also documented **Fysbis**, a Linux backdoor linked to Sofacy infrastructure, showing the group’s cross-platform capability and continued use of modular implants for covert access. Defenders and platform operators responded with both technical guidance and infrastructure disruption. The UK’s NCSC published indicators of compromise and detection guidance for APT28 malware including **X-Tunnel**, **X-Agent**, and **CompuTrace**, while Microsoft said it obtained a court order to seize seven domains used by the group and redirect them to a sinkhole after the infrastructure was used to target Ukrainian institutions as well as U.S. and EU government and think-tank networks for persistent access and exfiltration. Across the referenced reporting, APT28’s operations were characterized by curated targeting, evolving malware variants, and repeated use of attacker-controlled domains and command-and-control systems to support intelligence collection.
Aug 15, 2026
**APT28 (Sednit/Fancy Bear)**, a Russian GRU-linked cyber-espionage group associated with **Unit 26165**, has been assessed by ESET to have reactivated a more advanced, custom tooling set beginning in **April 2024**, shifting from a period where its most sophisticated malware was less frequently observed. The activity has focused on **long-term surveillance of Ukrainian targets**, particularly **military personnel**, and includes the use of multiple implants: **BEARDSHELL** (a .NET-based implant used to execute **PowerShell** commands) and **COVENANT** (used alongside BEARDSHELL), as well as **SLIMAGENT**, which performs keylogging, screenshot capture, and clipboard collection. ESET and reporting based on its findings link SLIMAGENT to historical **XAgent** development, citing code and logging-format similarities consistent with an evolution of APT28’s earlier backdoor ecosystem. ESET’s reporting indicates the operators use a **dual-implant architecture** to improve resilience, including leveraging **legitimate cloud services** for command-and-control; BEARDSHELL was described as using *Icedrive* as a C2 channel, and the overall approach was characterized as designed to maintain durable access for espionage operations extending through **2025 into 2026**. Separate weekly threat-bulletin coverage that mentions unrelated breaches and other threat activity does not add material detail to the APT28/Sednit campaign described above and should not be treated as part of the same incident reporting.
Jun 29, 2026