APT28 regularly deploys both publicly available (ex:

Mimikatz) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018) They have also dumped the LSASS process memory using the MiniDump function.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT28 has used tools to perform keylogging.(Citation: Microsoft SIR Vol 19)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm.

APT28 has also obfuscated payloads with base64, XOR, and RC4.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)(Citation: Talos Seduploader Oct 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows|T1542.003|Bootkit|

APT28 has deployed a bootkit along with

Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of

BlackEnergy.(Citation: ESET Sednit Part 3)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|