APT28 regularly deploys both publicly available (ex:

Mimikatz) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018)(Citation: US District Court Indictment GRU Oct 2018)  |
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|Later implants used by

APT28, such as

CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.(Citation: FireEye APT28)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT28 has used the WindowStyle parameter to conceal

PowerShell windows.(Citation: Palo Alto Sofacy 06-2018) (Citation: McAfee APT28 DDE1 Nov 2017)|
|mitre-attack|enterprise-attack,mobile-attack|SaaS,Office 365,Azure AD,Google Workspace,Containers|T1528|Steal Application Access Token|

APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".(Citation: Trend Micro Pawn Storm OAuth 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Office 365,SaaS,Google Workspace,Containers,IaaS,Azure AD|T1550.001|Application Access Token|

APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.(Citation: Trend Micro Pawn Storm OAuth 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|