APT28 has obtained and used open-source tools like

Koadic,

Mimikatz, and

Responder.(Citation: Palo Alto Sofacy 06-2018)(Citation: Securelist Sofacy Feb 2018)(Citation: FireEye APT28 Hospitality Aug 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.(Citation: US District Court Indictment GRU Oct 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1589.001|Credentials|

APT28 has harvested user's login credentials.(Citation: Microsoft Targeting Elections September 2020)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1598|Phishing for Information|

APT28 has used spearphishing to compromise credentials.(Citation: Microsoft Targeting Elections September 2020)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1567|Exfiltration Over Web Service|

APT28 can exfiltrate data over Google Drive.(Citation: TrendMicro Pawn Storm Dec 2020) |
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1595.002|Vulnerability Scanning|

APT28 has performed large-scale scans in an attempt to find vulnerable servers.(Citation: TrendMicro Pawn Storm 2019)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

APT28 has routed traffic over

Tor and VPN servers to obfuscate their activities.(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|