apt28-fancy-bear

name	apt28-fancy-bear
description	Adversary-emulation profile for APT28 (G0007 / Fancy Bear / Forest Blizzard / Sofacy / STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, STRONTIUM, Pawn Storm, GRU 26165, G0007, Russian GRU espionage emulation, NTLM relay / CVE-2023-23397 Outlook, GooseEgg print spooler, password spraying, credential harvesting, NATO/Ukraine logistics targeting, election interference TTPs","tags":"apt28, fancy-bear, forest-blizzard, sofacy, strontium, gru, russia, espionage, nation-state, g0007, adversary-emulation, mitre-attack","mitre_attack":"T1583.001, T1583.003, T1583.006, T1586.002, T1595.002, T1589.001, T1591, T1598.003, T1566.001, T1204.001, T1204.002, T1669, T1190, T1189, T1203, T1210, T1221, T1133, T1199, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1047, T1204, T1569.002, T1547.001, T1037.001, T1137.002, T1546.015, T1542.003, T1547.004, T1547.005, T1547.006, T1547.013, T1543.001, T1543.002, T1543.003, T1505.003, T1574.001, T1548.002, T1068, T1134.001, T1134.005, T1027, T1027.002, T1027.011, T1027.013, T1036, T1036.005, T1070.004, T1070.006, T1112, T1218.005, T1218.010, T1218.011, T1553.004, T1564.001, T1564.003, T1564.004, T1497, T1202, T1003.001, T1003.002, T1003.003, T1003.004, T1003.006, T1110.001, T1110.003, T1555.003, T1555.004, T1056.001, T1557.001, T1557.004, T1040, T1528, T1552.001, T1098.002, T1558.001, T1558.002, T1606, T1087.001, T1087.002, T1083, T1046, T1135, T1518.001, T1018, T1082, T1016, T1016.002, T1482, T1201, T1021.001, T1021.002, T1021.004, T1550.002, T1119, T1005, T1039, T1025, T1113, T1114.002, T1213.002, T1560.001, T1074.001, T1074.002, T1071.001, T1071.003, T1090.001, T1090.003, T1102.002, T1105, T1573.001, T1573.002, T1568.002, T1008, T1095, T1572, T1041, T1048.002, T1567, T1052.001, T1020, T1030, T1561.001, T1498, T1602"}

APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile

APT28 (MITRE ATT&CK G0007) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.

Attribution & motivation

• Sponsor / nation: Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.
• Motivation: Primarily strategic intelligence collection (espionage) aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include influence / information operations (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional destructive / disruptive action (TV5Monde disruption, WADA DDoS).
• Attribution confidence: High. Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI/MFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).

Targeting

• Sectors: Government and diplomatic bodies; defense, military, and aerospace; logistics, transport, and IT/technology firms supporting aid to Ukraine (since 2022); think tanks, NGOs, and political organizations/campaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.
• Regions: NATO and allied states — heavy focus on Ukraine, Western/Eastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.
• Victim profile: High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook/OWA, Roundcube, Yahoo/Google) and edge/network devices as footholds.