Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT28 · Nation-state · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT28

  • Pawn Storm
  • FANCY BEAR
  • Sednit
  • SNAKEMACKEREL
  • Tsar Team
  • TG-4127
  • STRONTIUM
  • Swallowtail

state sponsor · Russian FederationMITRE G0007 ↗

APT28 — ATT&CK roseAP

attack rose · 93 techniques across 15 tactics

What changed

ledger · newest first
  1. —todaynew CVE23 new CVEs: CVE-2009-3129, CVE-2010-3333, CVE-2012-0158, CVE-2013-2729, CVE-2014-1761, CVE-2014-4076 +17 more
  2. —1 mo agonew CVE1 new CVE: CVE-2026-21509

Analyst brief

misp-galaxy + mitre-attack

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

Observed targets (as stated by the sources)

19 countries · 4 sectors
GeorgiaFranceJordanUnited StatesHungaryArmeniaTajikistanJapanUkraineBelgiumPakistanTürkiyeMongoliaUnited KingdomGermanyPolandAfghanistanKazakhstanChinaAssessed origin: Russia

assessed origin · Russiaobserved targets · 19

countries · 19

  • Georgia
  • France
  • Jordan
  • United States
  • Hungary
  • Armenia
  • Tajikistan
  • Japan
  • Ukraine
  • Belgium
  • Pakistan
  • Türkiye
  • Mongolia
  • United Kingdom
  • Germany
  • Poland
  • Afghanistan
  • Kazakhstan
  • China

sectors · 4

  • Government
  • Military
  • Government, Administration
  • Security Service

also stated: World Anti-Doping Agency, NATO, Asia Pacific Economic Cooperation, International Association of Athletics Federations, OSCE, European Commission

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

93 techniques · 15 of 15 tactics

  1. Reconnaissance

    6 techniques

  2. Resource development

    7 techniques

  3. Initial access

    5 techniques

  4. Execution

    6 techniques

  5. Persistence

    6 techniques

  6. Privilege escalation

    2 techniques

  7. Stealth

    17 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    9 techniques

  10. Discovery

    3 techniques

  11. Lateral movement

    5 techniques

  12. Collection

    13 techniques

  13. Command and control

    9 techniques

  14. Exfiltration

    3 techniques

  15. Impact

    1 technique

select a technique

Arsenal

19 malware · 10 tools
Malware
Malware · 19ATT&CK
CHOPSTICKS0023 ↗
DealersChoiceS0243 ↗
ADVSTORESHELLS0045 ↗
CannonS0351 ↗
KomplexS0162 ↗
HIDEDRVS0135 ↗
JHUHUGITS0044 ↗
XTunnelS0117 ↗
DrovorubS0502 ↗
LAMEHUGS9035 ↗
CORESHELLS0137 ↗
OLDBAITS0138 ↗
DowndelphS0134 ↗
XAgentOSXS0161 ↗
USBStealerS0136 ↗
ZebrocyS0251 ↗
reGeorgS1187 ↗
FysbisS0410 ↗
LoJaxS0397 ↗
Tools
Tools · 10ATT&CK
WevtutilS0645 ↗
certutilS0160 ↗
NetS0039 ↗
ForfilesS0193 ↗
MimikatzS0002 ↗
KoadicS0250 ↗
WinexeS0191 ↗
ResponderS0174 ↗
cipher.exeS1205 ↗
TorS0183 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT28 is cited as exploiting

2 on CISA KEV
  1. CVE-2025-27915KEV2026-10-17
    1. “SSSCIP reported that Russia-linked cyberespionage group APT28 exploited XSS flaws in Roundcube and Zimbra webmail ( CVE-2023-43770 , CVE-2024-37383 , CVE-2025-49113 , CVE-2024-27443 , CVE-2025-27915 ) for zero-click attacks.”

      cited as exploiting · source: securityaffairs.com ↗ · 2026-10-17

  2. CVE-2009-31292026-10-17
    1. “CVE-2009-3129: Microsoft Office Compatibility Pack for Remote Attacks”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  3. CVE-2010-33332026-10-17
    1. “CVE-2010-3333: RTF Stack Buffer Overflow Vulnerability for Microsoft Office”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  4. CVE-2012-01582026-10-17
    1. “CVE-2012-0158: ActiveX Corruption Vulnerability for Microsoft Office”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  5. CVE-2013-27292026-10-17
    1. “CVE-2013-2729: Integer Overflow in Adobe Reader and Acrobat vulnerability”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  6. CVE-2014-17612026-10-17
    1. “CVE-2014-1761: Microsoft Office Denial of Service (Memory Corruption)”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  7. CVE-2015-24242026-10-17
    1. “CVE-2015-2424: Microsoft PowerPoint Memory Corruption Vulnerability”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  8. CVE-2015-16412026-10-17
    1. “CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  9. CVE-2016-41172026-10-17
    1. “CVE-2016-4117: Adobe Flash Player Remoted Attack Vulnerability”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  10. CVE-2016-72552026-10-17
    1. “CVE-2016-7255: Microsoft Windows Elevation of Privilege Vulnerability”

      cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17

  11. CVE-2023-233972026-10-17
    1. “Campaign 23.056 tracked a subcluster of Russian cyber espionage group APT28 that, starting in late August, conducted credential harvesting and exploited Microsoft Outlook vulnerability CVE-2023-23397.”

      cited as exploiting · source: services.google.com ↗ · 2026-10-17

    2. “APT28 nutzt diverse Angriffsvektoren, z. B. Outlook -Schwachstelle CVE-2023-23397 (via E-Mail)”

      cited as exploiting · source: bsi.bund.de ↗ · 2026-10-17

    3. “The threat actor is exploiting two vulnerabilities. The first (CVE-2023-23397) is a Microsoft Outlook elevation of privilege vulnerability.”

      cited as exploiting · named nearby · source: ics-cert.kaspersky.com ↗ · 2026-10-17

  12. CVE-2022-380282026-10-17
    1. “Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    3. “Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    4. “Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    5. “Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  13. CVE-2015-49022026-10-17
    1. “APT28 has used CVE-2015-4902 to bypass security features.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  14. CVE-2015-23872026-10-17
    1. “APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  15. CVE-2017-02632026-10-17
    1. “APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  16. CVE-2014-40762026-10-17
    1. “APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  17. CVE-2017-02622026-10-17
    1. “APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  18. CVE-2015-17012026-10-17
    1. “APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  19. CVE-2023-388312026-10-17
    1. “Proofpoint also reported the use of the vulnerability CVE-2023-38831 by TA422 (aka APT28).”

      cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17

    2. “TAG observed that FROZENLAKE used a free hosting provider to serve CVE-2023-38831 to target users in Ukraine.”

      cited as exploiting · source: blog.google ↗ · 2026-10-17

    3. “the group Microsoft tracks as Forest Blizzard targeted organizations globally using lures in a RAR archive exploiting the CVE-2023-38831 vulnerability.”

      cited as exploiting · source: therecord.media ↗ · 2026-10-17

    4. “WinRAR-Schwachstelle CVE-2023-38831 (via E-Mail-Anhang)”

      cited as exploiting · named nearby · source: bsi.bund.de ↗ · 2026-10-17

  20. CVE-2024-274432026-10-17
    1. “SSSCIP reported that Russia-linked cyberespionage group APT28 exploited XSS flaws in Roundcube and Zimbra webmail ( CVE-2023-43770 , CVE-2024-37383 , CVE-2025-49113 , CVE-2024-27443 , CVE-2025-27915 ) for zero-click attacks.”

      cited as exploiting · source: securityaffairs.com ↗ · 2026-10-17

  21. CVE-2024-373832026-10-17
    1. “SSSCIP reported that Russia-linked cyberespionage group APT28 exploited XSS flaws in Roundcube and Zimbra webmail ( CVE-2023-43770 , CVE-2024-37383 , CVE-2025-49113 , CVE-2024-27443 , CVE-2025-27915 ) for zero-click attacks.”

      cited as exploiting · source: securityaffairs.com ↗ · 2026-10-17

  22. CVE-2025-491132026-10-17
    1. “SSSCIP reported that Russia-linked cyberespionage group APT28 exploited XSS flaws in Roundcube and Zimbra webmail ( CVE-2023-43770 , CVE-2024-37383 , CVE-2025-49113 , CVE-2024-27443 , CVE-2025-27915 ) for zero-click attacks.”

      cited as exploiting · source: securityaffairs.com ↗ · 2026-10-17

  23. CVE-2023-437702026-10-17
    1. “SSSCIP reported that Russia-linked cyberespionage group APT28 exploited XSS flaws in Roundcube and Zimbra webmail ( CVE-2023-43770 , CVE-2024-37383 , CVE-2025-49113 , CVE-2024-27443 , CVE-2025-27915 ) for zero-click attacks.”

      cited as exploiting · source: securityaffairs.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Named alongside APT28 only

CVEs named in the same dispatches as APT28
CVEStatusEPSS
CVE-2026-21509Actively exploited73%

These CVEs appeared in the same dispatches as APT28. That is an association in reporting, not a claim that this group used them — read the dispatch, then the vendor advisory, before you treat it as either.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malwareIBM ↗
  2. 2023APT28: From Initial Damage to Domain Controller Threats in an HourCERT-UA ↗
  3. 2018Update on Pawn Storm: New Targets and Politically Motivated CampaignsTrend Micro ↗
  4. 2017At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber OperationsFireEye ↗
  5. 2017Enhanced Analysis of GRIZZLY STEPPE ActivityUS-CERT ↗
  6. 2017Dissecting the APT28 Mac OS X PayloadBitdefender ↗

Take it with you

keyless · no signup

References

62 sources
  1. 1.attack.mitre.org/groups/G0007
  2. 2.en.wikipedia.org/wiki/Fancy_Bear
  3. 3.en.wikipedia.org/wiki/Sofacy_Group
  4. 4.bbc.com/news/technology-37590375
  5. 5.bbc.co.uk/news/technology-45257081
  6. 6.cfr.org/interactive/cyber-operations/apt-28
  7. 7.apnews.com/4d174e45ef5843a0ba82e804f080988f
  8. 8.voanews.com/a/iaaf-hack-fancy-bears/3793874.html
  9. 9.securelist.com/a-slice-of-2017-sofacy-activity/83930
  10. 10.dw.com/en/hackers-lurking-parliamentarians-told/a-19564630
  11. +52 more in the JSON record

Track APT28 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.