APT28 macro uses the command

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.(Citation: FireEye APT28)(Citation: FireEye APT28 Hospitality Aug 2017)(Citation: MS17-010 March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1037.001|Logon Script (Windows)|An

APT28 loader Trojan adds the Registry key

APT28 has retrieved internal documents from machines inside victim environments, including by using

Forfiles to stage documents before exfiltration.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.(Citation: FireEye APT28)(Citation: FireEye APT28 Hospitality Aug 2017)

APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.(Citation: US District Court Indictment GRU Oct 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1559.002|Dynamic Data Exchange|

APT28 has delivered

JHUHUGIT and

Koadic by executing PowerShell commands through DDE in Word documents.(Citation: McAfee APT28 DDE1 Nov 2017)(Citation: McAfee APT28 DDE2 Nov 2017)(Citation: Palo Alto Sofacy 06-2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1070.004|File Deletion|