APT28

☆ pin

MITRE G0007Also known as BlueDelta, Sednit, Unit 26165, Forest Blizzard, Pawn Storm, Fighting Ursa, GruesomeLarch, Fancy Bear, UAC-0001, FancyBear, Sofacy

Reports

First seen

Nov 22, 2024

Last seen

Sep 24, 2026

Motivation

Espionage, Geopolitical

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Government ×9 Other ×6 Energy & Utilities ×1

Victim regions

×1

×4

Ukraine×4

Canada×1

United States×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×16T1566 Phishing ×16T1041 Exfiltration Over C2 Channel ×12T1059 Command and Scripting Interpreter ×10T1078 Valid Accounts ×8T1071 Application Layer Protocol ×6T1003 OS Credential Dumping ×6T1486 Data Encrypted for Impact ×6T1598 Phishing for Information ×5T1195 Supply Chain Compromise ×5T1110 Brute Force ×5T1021 Remote Services ×5

Indicators

cve ×67filename ×55domain ×43url ×38hash_sha256 ×29ip_v4 ×26email ×5registry_key ×4hash_sha1 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

APT28

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Roundcube Webmail CVE-2026-48842 SQL Injection Actively Exploited

Leaked Russian Cyber-Operations Training Materials Reveal GRU Recruitment Pipeline

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

BlueDelta Targets Defense and Diplomacy with HOOKEDGE Backdoor

CISA orders urgent patching of actively exploited Zimbra flaw

Critical Zimbra RCE flaw now actively exploited in attacks

Ukrainian Asset Recovery Agency Targeted by Cyberattack Amid Oligarch Asset Seizure Process

Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

US and allies warn of Russian critical infrastructure attacks

Zimbra urges customers to patch critical web client XSS flaw

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

Canada's CSIS Used First Warrant to Remotely Clean Botnet-Infected Devices

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

ESET APT Activity Report Q4 2025–Q1 2026

Ukraine reports Russia deploying AI-powered malware in cyberwar operations

Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

CERT-EU Cyber Brief April 2026 – Espionage, Supply-Chain Attacks, and Critical Infrastructure Threats

Russia's GRU-Linked Forest Blizzard Harvests Microsoft OAuth Tokens via Router DNS Hijacking

CERT-EU Cyber Brief March 2026 – Espionage, Supply-Chain Attacks, Iran Conflict Disruptions

Threat Intelligence Report – 30 March: FBI Director Account Breach, Port Ransomware, Supply Chain Compromises

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

ClickFix Campaigns Targeting Windows and macOS: Five Distinct Clusters

February 2026 CVE Landscape: 13 Critical Vulnerabilities, 43% Drop from January

Sednit reloaded: Advanced implant team returns with BeardShell and Covenant

CERT-EU Cyber Brief February 2026: APT28, China espionage, AI supply-chain attacks, Qilin ransomware

Preparing for Russia's New Generation Warfare in NATO Territory

January 2026 CVE Landscape: 23 Critical Vulnerabilities, APT28 Exploits Microsoft Office Zero-Day

2025 Cloud Threat Hunting and Defense Landscape

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond