APT28
View MITRE Group Page ↗Key Facts
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G0007 (APT28).
- Linked to 2 primary court prosecution record(s) with $25.0 million documented loss.
- Identified 3 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1566.002 Spearphishing Link | 1 incidents |
| T1059.001 PowerShell | 1 incidents |
| T1583.001 Domains | 1 incidents |
| T1071.004 DNS Tunneling | 1 incidents |
| T1546.003 Windows Management Instrumentation Event Subscription | 1 incidents |
| T1566.001 Spearphishing Attachment | 1 incidents |
Prosecution Cases Attributed to APT28
U.S. v. Netyksho et al. (APT28 / GRU Unit 26165 DNC Hack)
Twelve Russian GRU military intelligence officers charged with hacking into the Democratic National Committee and Hillary Clinton presidential campaign servers, exfiltrating emails, and orchestrating strategic leaks via DCLeaks and Guccifer 2.0.
U.S. & International Action: Dmitry Badin (German Bundestag Hack)
Russian GRU military officer charged with the 2015 cyber intrusion into the German Federal Parliament (Bundestag), which compromised parliamentary IT infrastructure and exfiltrated thousands of emails from Chancellor Angela Merkel's office.
Indicted Operatives & Dispositions (3)
GRU cyber operator indicted in D.D.C. and subject to German federal arrest warrant for the Bundestag intrusion.
Commander of GRU Unit 26165 indicted for the 2016 DNC cyber intrusions.
GRU Unit 26165 department head overseeing spearphishing operations.
Documented TTP Signature for APT28
Test Controls in Stack Audit →Adversaries send spearphishing emails containing malicious hyperlinks to lure users into downloading payloads or entering credentials.
Adversaries abuse the Windows PowerShell command environment to execute commands and download malicious payloads.
Adversaries register typo-squatted or deceptively named domain names for phishing campaigns.
Adversaries encode commands and data within DNS query and response packets.
Adversaries create WMI event filters and consumers to trigger persistent payload execution upon system events.
Adversaries send spearphishing emails with malicious attachments to gain initial access to victim systems.