APT28

MITRE G0007Also known as Fancy Bear, FancyBear, UAC-0001

Reports

First seen

Jan 5

Last seen

Jun 22

Motivation

espionage, email collection and persistent access f, military cyberwarfare

Targeting

Sectors

other ×4government ×1

Victim regions

Canada ×1Ukraine ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×7T1566 Phishing ×6T1486 Data Encrypted for Impact ×5T1059 Command and Scripting Interpreter ×5T1003 OS Credential Dumping ×4T1041 Exfiltration Over C2 Channel ×4T1078 Valid Accounts ×4T1021 Remote Services ×4T1195 Supply Chain Compromise ×3T1598 Phishing for Information ×3T1110 Brute Force ×2T1566.002 Phishing: Spearphishing Link ×2

Indicators

cve ×49ip_v4 ×22filename ×20domain ×9email ×5url ×4hash_sha256 ×2registry_key ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Canada's CSIS Used First Warrant to Remotely Clean Botnet-Infected Devices

The Hacker NewsJun 22 High

Ukraine reports Russia deploying AI-powered malware in cyberwar operations

The Record (Recorded Future News)May 20 High

CERT-EU Cyber Brief April 2026 – Espionage, Supply-Chain Attacks, and Critical Infrastructure Threats

CERT-EU Threat IntelMay 4 High

CERT-EU Cyber Brief March 2026 – Espionage, Supply-Chain Attacks, Iran Conflict Disruptions

CERT-EU Threat IntelApr 1 Critical

Threat Intelligence Report – 30 March: FBI Director Account Breach, Port Ransomware, Supply Chain Compromises

Check Point ResearchMar 30 Critical

February 2026 CVE Landscape: 13 Critical Vulnerabilities, 43% Drop from January

Recorded Future InsiktMar 12 High

CERT-EU Cyber Brief February 2026: APT28, China espionage, AI supply-chain attacks, Qilin ransomware

CERT-EU Threat IntelMar 2 Critical

January 2026 CVE Landscape: 23 Critical Vulnerabilities, APT28 Exploits Microsoft Office Zero-Day

Recorded Future InsiktFeb 24 High

2025 Cloud Threat Hunting and Defense Landscape

Recorded Future InsiktFeb 19 High

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond

CERT-EU Threat IntelJan 5

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.