APT28 - G0007

Created: 2017-05-31T21:31:48.664Z

Modified: 2023-03-26T17:51:20.401Z

Contributors: Sébastien Ruel, CGI,Drew Church, Splunk,Emily Ratliff, IBM,Richard Gold, Digital Shadows

Aliases

APT28,IRON TWILIGHT,SNAKEMACKEREL,Swallowtail,Group 74,Sednit,Sofacy,Pawn Storm,Fancy Bear,STRONTIUM,Tsar Team,Threat Group-4127,TG-4127

Description

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)