Threat Actor Characterization
APT28
ID: 466b1115072b30c50782a9670d23380663269| Fancy Bear | Forest Blizzard | FR******** | Gr****** |
| Gr*********** | IR*********** | Pa******** | S***** |
| SN*********** | S***** | ST******* | Sw********* |
| TG***** | Th*************** | Ts******* | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Fancy Bear (APT28) is a Russia-linked state-sponsored intrusion set commonly attributed to GRU Unit 26165. Public reporting and government advisories describe email-centric initial access (including Outlook vulnerability exploitation), credential material abuse, and the use of compromised routers/edge infrastructure to facilitate operations. Activity is primarily espionage-driven with targeting across NATO-aligned governments, defense, logistics and supporting organizations.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 |
|
| T1203 | Exploitation for Client Execution | TA0002 | |
| T1550.002 | Pass the Hash | TA0005 TA0008 |
|
| T1098 | Account Manipulation | TA0003 TA0004 |
|
| T1114 | Email Collection | TA0009 |
|
| T1021.001 | Remote Desktop Protocol | TA0008 |
|
| T1584.004 | Server | TA0042 | |
| T1498 | Network Denial of Service | TA0040 |
|
| T1204.002 | Malicious File | TA0002 |
|
APT28 / Fancy Bear
Classification: TLP:WHITE — Public/OSINT-derived intelligence suitable for broad distribution.
Executive Summary
- APT28 (commonly “Fancy Bear”, “Sofacy”, “Sednit”, “Forest Blizzard”) is widely attributed to Russia’s GRU, specifically Unit 26165, and has been active since at least 2004.
- Operational focus is intelligence collection and influence enablement against government, defense, diplomatic, political-party, media, and logistics/transport targets—especially across Europe and Ukraine-adjacent ecosystems.
- Recent publicly documented activity highlights (a) infrastructure concealment via compromised SOHO/edge routers and (b) webmail/credential theft patterns—including Outlook CVE-2023-23397 exploitation and webmail-focused operations.
- Assessed home base: Russia (state-aligned).
- Attribution: GRU 85th Main Special Service Center (GTsSS), military unit 26165.
- Strategic objectives: military/political intelligence collection; support to Russian foreign policy and military operations; periodic “hybrid” influence amplification via theft-and-leak and narrative shaping.
- Target sets: Western government ministries, defense contractors, think tanks, embassies, political parties, and logistics/transport entities involved in assistance flows to Ukraine.
- Operational tradecraft: repeatable spearphishing and credential collection at scale; opportunistic exploitation of exposed infrastructure; frequent tool/infra refresh and layered proxying.
- Information effects: theft-and-leak operations can be timed to political milestones to maximize friction and distrust.
Executive Analyst Brief for Decision Makers — APT28 / Fancy BearSituation: APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) is a long-running, Russia state-aligned cyber-espionage actor attributed to GRU Unit 26165, active since at least 2004. TLP:WHITEDeliverable: Executive Analyst Brief for Decision Makers Why this matters nowPublicly documented operations show sustained targeting of European government/military and logistics entities, including organizations linked to assistan
Hunting Playbook — APT28 / Fancy Bear
Priority & context: APT28 is a persistent, state-backed espionage actor. Recent OSINT highlights emphasize router-based concealment, webmail credential theft, and selective exploitation (including Outlook CVE-2023-23397). This playbook prioritizes identity + edge-device telemetry because those controls reduce risk even when infrastructure rotates quickly. (OSINT-03, OSINT-02)