APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.(Citation: ESET Zebrocy May 2019)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1221|Template Injection|

APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro. (Citation: Unit42 Sofacy Dec 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.(Citation: Securelist Sofacy Feb 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1014|Rootkit|

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as

LoJax.(Citation: Symantec APT28 Oct 2018)(Citation: ESET LoJax Sept 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

APT28 has collected emails from victim Microsoft Exchange servers.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1059.001|PowerShell|

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.(Citation: Palo Alto Sofacy 06-2018)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1560|Archive Collected Data|