apt28-fancy-bear

# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile APT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection. ## Attribution & motivation - **Sponsor / nation:** Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit. - **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include **influence / information operations** (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional **destructive / disruptive** action (TV5Monde disruption, WADA DDoS). - **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI/MFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET). ## Targeting - **Sectors:** Government and diplomatic bodies; defense, military, and aerospace; **logistics, transport, and IT/technology firms supporting aid to Ukraine** (since 2022); think tanks, NGOs, and political organizations/campaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy. - **Regions:** NATO and allied states — heavy focus on Ukraine, Western/Eastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations. - **Victim profile:** High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook/OWA, Roundcube, Yahoo/Google) and edge/network devices as footholds. ## Notable campaigns - **2015-04 — TV5Monde disruption.** French broadcaster's 11 channels and online presence knocked offline behind a false "CyberCaliphate" hacktivist persona; French investigators and infrastructure overlap tied it to APT28. (securityaffairs / Wikipedia background) - **2015 — German Bundestag intrusion.** Compromise of the German federal parliament network; the UK later sanctioned GRU Unit 26165 officers for it. (gov.uk) - **2016 — U.S. election interference (DNC / DCCC / Clinton campaign).** Spearphishing and credential theft, lateral movement DCCC→DNC, and hack-and-leak. Detailed in the July 2018 DOJ/Mueller indictment of 12 GRU officers. (justice.gov / FBI) - **2014-2018 — WADA / USADA / OPCW / Spiez.** Remote and close-access ("Wi-Fi") operations against anti-doping and chemical-weapons bodies, including a 2016 DDoS and leak of athlete medical data; charged in the October 2018 DOJ indictment of seven GRU officers. (justice.gov / NPR) - **2018 — LoJax UEFI rootkit.** ESET documented the first in-the-wild UEFI rootkit, used by APT28 for firmware-level persistence surviving OS reinstall. (MITRE software S0397 / ESET) - **2022-2025 — Western logistics & tech targeting (aid to Ukraine).** Joint CISA advisory **AA25-141A**: password spraying, spearphishing, Outlook NTLM coercion (CVE-2023-23397), Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and WinRAR (CVE-2023-38831) against logistics/IT firms and IP-camera networks. (CISA AA25-141A) - **2023 — Outlook NTLM (CVE-2023-23397) exploitation.** Zero-click NTLM-hash theft via crafted Outlook calendar reminders; documented by Microsoft and Unit 42 ("Fighting Ursa"). (microsoft.com / unit42) - **2024-04 — GooseEgg / Print Spooler (CVE-2022-38028).** Microsoft disclosed APT28's custom GooseEgg launcher abusing Windows Print Spooler for SYSTEM-level privilege escalation; CISA added the CVE to the KEV catalog. (microsoft.com) - **2023-04 — Cisco router operations.** Joint CISA/NCSC advisory **AA23-108** on APT28 exploiting SNMP weaknesses (CVE-2017-6742) to deploy "Jaguar Tooth" and conduct reconnaissance on Cisco IOS routers. (CISA AA23-108) - **2025-04/07 — France formal attribution.** France's MFA/ANSSI publicly attributed a decade of intrusions against French entities (incl. TV5Monde lineage and government/defense targets) to APT28. (diplomatie.gouv.fr) ## TTPs by ATT&CK tactic ### Initial Access - **T1566.001** — Spearphishing attachments: weaponized Office docs and RAR archives (incl. WinRAR CVE-2023-38831). - **T1598.003** — Spearphishing links for credential harvesting (fake login pages on Blogspot, lookalike webmail). - **T1204.001 / T1204.002** — User execution of malicious links and macro-laden files. - **T1190** — Exploit public-facing apps: Exchange (CVE-2020-0688, CVE-2020-17144), Roundcube CVEs, SQLi. - **T1189** — Drive-by compromise via custom exploit kits / XSS. - **T1133** — External remote services: VPN/Tor fronting for brute-force and access. - **T1199** — Trusted relationship: pivoted from DCCC to DNC network. - **T1669** — Wi-Fi networks: "close-access" exploitation of open/nearby Wi-Fi (incl. "nearest-neighbor" pivots). - **T1078 (implied)** — Valid accounts obtained via spraying/phishing reused for access. ### Execution - **T1059.001 / .003 / .004 / .005 / .006** — PowerShell, Windows cmd/batch, Unix shell (Drovorub), VBScript (Koadic), Python (reGeorg, LAMEHUG). - **T1047** — WMI via Koadic and the LAMEHUG implant. - **T1203** — Exploitation for client execution (CVE-2017-0262 in Office). - **T1569.002** — Service execution via Net/Koadic. - **T1221** — Template injection: Word docs pulling remote weaponized templates. ### Persistence - **T1547.001** — Registry Run keys / Startup folder. - **T1037.001** — Logon script via `UserInitMprLogonScript`. - **T1137.002** — Office Test persistence. - **T1546.015** — COM hijacking (MMDeviceEnumerator). - **T1542.003** — Bootkit (Downdelph) and **LoJax UEFI rootkit** (firmware persistence). - **T1547.004 / .005 / .006 / .013** — Winlogon Helper DLL (Cannon), SSP, Linux kernel modules (Drovorub), XDG autostart (Fysbis). - **T1543.001 / .002 / .003** — macOS Launch Agent (Komplex), Linux systemd (Fysbis), Windows service (JHUHUGIT). - **T1505.003** — Web shell (reGeorg on OWA). - **T1574.001** — DLL hijacking (Downdelph). ### Privilege Escalation - **T1068** — Exploitation for privesc: CVE-2014-4076, CVE-2015-1701, CVE-2015-2387, CVE-2017-0263, and **CVE-2022-38028 (Print Spooler, via GooseEgg)**. - **T1548.002** — UAC bypass (Koadic, Downdelph). - **T1134.001 / .005** — Token impersonation (CVE-2015-1701 → SYSTEM) and SID-History injection (Mimikatz). ### Defense Evasion - **T1027 / .002 / .011 / .013** — Obfuscation: base64/XOR/RC4, software packing (Zebrocy), fileless storage (CHOPSTICK), encrypted/encoded files. - **T1036 / .005** — Masquerading: renamed WinRAR, file-extension and location spoofing. - **T1070.004 / .006** — File deletion (CCleaner) and timestomping. - **T1112** — Registry modification (LoJax). - **T1218.005 / .010 / .011** — Mshta/Regsvr32 (Koadic), Rundll32 (CHOPSTICK). - **T1553.004** — Install root certificate via certutil. - **T1564.001 / .003 / .004** — Hidden files, hidden PowerShell windows (`-WindowStyle Hidden`), NTFS attribute hiding (LoJax). - **T1497** — Sandbox/VM evasion (CHOPSTICK). - **T1202** — Indirect command execution via Forfiles. ### Credential Access - **T1110.001 / .003** — Password guessing and **large-scale password spraying** (reconstituted spray infra, Tor/VPN-fronted). - **T1557.001** — NBT-NS/LLMNR poisoning (Responder). - **T1187 / CVE-2023-23397** — **Forced NTLM authentication / coercion** via crafted Outlook reminders to capture Net-NTLM hashes. - **T1003.001 / .002 / .003 / .004 / .006** — LSASS dump, SAM via `reg save`, NTDS via ntdsutil/VSS, LSA secrets, DCSync (Mimikatz). - **T1555.003 / .004** — Browser credential theft (XAgentOSX, Zebrocy, OLDBAIT), Windows Credential Manager. - **T1056.001** — Keylogging. - **T1528** — Steal application access tokens via OAuth apps masquerading as Google/Yahoo. - **T1098.002** — Add mailbox delegate / ApplicationImpersonation permissions via PowerShell (Exchange). - **T1558.001 / .002** — Golden/Silver Kerberos tickets (Mimikatz). - **T1606** — Forge web credentials (phishing pages). - **T1552.001** — Credentials in files (XTunnel). ### Discovery - **T1087.001 / .002** — Local/domain account enumeration (Net, LAMEHUG). - **T1083** — File/directory discovery (Forfiles for PDF/Office docs). - **T1046 / T1135 / T1018** — Network service, share, and remote-system discovery (Koadic, Net, Zebrocy). - **T1016 / .002** — Network config and **Wi-Fi interface discovery** (for close-access ops). - **T1518.001** — Security software discovery (CHOPSTICK, netsh). - **T1482** — Domain trust discovery (LAMEHUG). - **T1201** — Password policy discovery (Net). - **T1082** — System information discovery (many families). ### Lateral Movement - **T1021.001 / .002 / .004** — RDP, SMB/admin shares, SSH (via reGeorg tunnel). - **T1550.002** — Pass-the-hash. - **T1210** — Exploitation of remote services (SMB RCE). ### Collection - **T1114.002** — Remote email collection from Exchange/OWA mailboxes. - **T1213.002** — Data from SharePoint repositories. - **T1005 / T1039 / T1025** — Local system, network-share, and removable-media collection. - **T1119** — Automated collection (publicly available tools on DCCC/DNC; USBStealer; LAMEHUG). - **T1113** — Screen capture (Cannon, XAgentOSX, Zebrocy). - **T1056.001** — Keylogging for collection. - **T1602** — Data from network devices (Cisco router config via SNMP). - **T1560.001** — Archive via WinRAR (password-protected) / PowerShell `Compress-Archive`. - **T1074.001 / .002** — Local staging (e.g., `C:\ProgramData`, `pi.log`) and remote staging on OWA server. ### Command & Control - **T1071.001 / .003** — Web (HTTP/S) and mail protocols (IMAP/POP3/SMTP via Google Mail) for C2. - **T1102.002** — Bidirectional C2 over Google Drive web service. - **T1568.002** — DGA (CHOPSTICK). - **T1008** — Fallback channels (CHOPSTICK, JHUHUGIT, XTunnel). - **T1090.001 / .003** — Internal proxy (`netsh portproxy`) and multi-hop proxy (Tor/VPN). - **T1572 / T1095** — Protocol tunneling (reGeorg) and non-application-layer protocols (Drovorub). - **T1573.001 / .002** — Symmetric and asymmetric encrypted channels. - **T1105** — Ingress tool transfer. ### Exfiltration - **T1041** — Exfil over C2 channel. - **T1048.002** — Exfil over alternate protocol: HTTPS via compromised OWA server. - **T1567** — Exfil over web service (Google Drive). - **T1030** — Data transfer size limits (split archives into <1MB chunks). - **T1052.001 / T1020** — Automated USB exfiltration (USBStealer) for air-gap bridging. ### Impact - **T1561.001** — Disk content wipe via `cipher.exe`. - **T1498** — Network DoS (2016 DDoS against WADA). ## Signature tooling & malware | Name | ATT&CK ID | Type | Public/Custom | |---|---|---|---| | CHOPSTICK / X-Agent | S0023 | Modular Windows implant (DGA, fileless) | Custom | | JHUHUGIT / Seduploader | S0044 | First-stage Windows implant | Custom | | ADVSTORESHELL | S0045 | Backdoor with custom archiving | Custom | | XTunnel | S0117 | Network proxy/tunnel | Custom | | CORESHELL / Sofacy | S0137 | Windows downloader/backdoor | Custom | | Downdelph | S0134 | Delphi backdoor + bootkit | Custom | | LoJax | S0397 | **UEFI rootkit** (firmware persistence) | Custom | | Drovorub | S0502 | Linux malware suite + kernel rootkit | Custom | | Fysbis | S0410 | Linux backdoor | Custom | | Komplex / XAgentOSX | S0162 / S0161 | macOS trojan / implant | Custom | | X-Agent for Android | S0314 | Android surveillance | Custom | | Zebrocy | S0251 | Multi-stage downloader/collector | Custom | | Cannon | S0351 | Backdoor with email-based exfil | Custom | | OLDBAIT | S0138 | Credential stealer | Custom | | USBStealer | S0136 | USB/air-gap exfil | Custom | | GooseEgg | (no ATT&CK software ID assigned) | Print Spooler privesc launcher (CVE-2022-38028) | Custom | | LAMEHUG | S9035 | LLM-assisted post-compromise implant | Custom | | reGeorg | S1187 | Web shell / SOCKS tunnel | Public (Living-off-tooling) | | Koadic | S0250 | Post-exploitation framework | Public | | Mimikatz | S0002 | Credential dumping | Public | | Responder | S0174 | LLMNR/NBT-NS poisoning | Public | | Tor | S0183 | Anonymity / proxy | Public | | Net / netsh / certutil / Wevtutil / Forfiles | S0039 / S0108 / S0160 / S0645 / S0193 | LOLBins | Built-in | > Note: "GooseEgg" is a Microsoft-attributed custom tool; it is **not** the same as ATT&CK software S1145 (Pikabot), so no false software ID is assigned here. ## Emulation guidance (Decepticon) > **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run destructive (T1561/T1498) or firmware (LoJax-style) actions outside an explicitly sanctioned, isolated lab. Map APT28's signature plays to Decepticon's own capabilities: - **Initial access — credential ops (T1110.003, T1598.003, T1566.001).** Use the phishing/credential-harvest skill to stand up lookalike webmail login pages; drive **slow, low-and-slow password spraying** (~few attempts/account/hour) against in-scope OWA/M365 endpoints, fronted through rotating egress to mimic Tor/VPN spray infra. Stage macro/RAR lures with the payload-builder; if WinRAR is in scope, emulate CVE-2023-38831 archive lures. - **NTLM coercion (T1187 / CVE-2023-23397, T1557.001).** With the AD/lateral-movement skill, run **Responder** for LLMNR/NBT-NS poisoning and emulate Outlook-reminder NTLM coercion to capture Net-NTLM hashes, then relay or crack offline. This is APT28's defining 2023-2025 play — prioritize it. - **Privilege escalation (T1068, T1548.002).** Use the privesc/defense-evasion skill to emulate **GooseEgg-style Print Spooler abuse (CVE-2022-38028)** for SYSTEM in a patched-vs-unpatched lab, and UAC bypass chains analogous to Koadic/Downdelph. - **Credential access (T1003.*, T1558.*, T1550.002).** Drive the AD skill / **Mimikatz** for LSASS dump, DCSync, golden/silver tickets, and pass-the-hash — mirroring APT28's domain-takeover pattern. - **C2 (T1071.001, T1102.002, T1090, T1572).** Use **Sliver** (c2 skill) over HTTPS as the primary channel; add a **mail-protocol or Google-Drive web-service profile** to emulate Cannon/Drive C2, and chain `netsh portproxy` internal proxies + reGeorg-style web-shell tunneling for pivoting.