APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

APT28 has renamed the WinRAR utility to avoid detection.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT28 has used

Tor and a variety of commercial VPN services to route brute force authentication attempts.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1030|Data Transfer Size Limits|

APT28 has split archived exfiltration files into chunks smaller than 1MB.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1048.002|Exfiltration Over Asymmetric Encrypted Non-C2 Protocol|

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

APT28 has collected files from various information repositories.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|