APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.(Citation: DOJ GRU Indictment Jul 2018)(Citation: ESET Zebrocy May 2019)(Citation: US District Court Indictment GRU Oct 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|Once

APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1211|Exploitation for Defense Evasion|

APT28 has used CVE-2015-4902 to bypass security features.(Citation: Bitdefender APT28 Dec 2015)(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Office 365|T1213.002|Sharepoint|