APT28 (G0007) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

CISA Known Exploited

About APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

View MITRE record ↗

Techniques by Tactic (93)

Reconnaissance

T1589.001 CredentialsT1591 Gather Victim Org InformationT1595.002 Vulnerability ScanningT1596 Search Open Technical DatabasesT1598 Phishing for InformationT1598.003 Spearphishing Link

Resource Development

T1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1584.008 Network DevicesT1586.002 Email AccountsT1588.002 ToolT1588.007 Artificial Intelligence

Initial Access

T1078 Valid AccountsT1078.004 Cloud AccountsT1091 Replication Through Removable MediaT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1669 Wi-Fi Networks

Execution

T1059.001 PowerShellT1059.003 Windows Command ShellT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange

Persistence

T1037.001 Logon Script (Windows)T1078 Valid AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1133 External Remote ServicesT1137.002 Office TestT1505.003 Web ShellT1542.003 BootkitT1546.015 Component Object Model HijackingT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1037.001 Logon Script (Windows)T1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1134.001 Token Impersonation/TheftT1546.015 Component Object Model HijackingT1547.001 Registry Run Keys / Startup Folder

Stealth

T1014 RootkitT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1078.004 Cloud AccountsT1134.001 Token Impersonation/TheftT1140 Deobfuscate/Decode Files or InformationT1211 Exploitation for StealthT1218.011 Rundll32T1221 Template InjectionT1542.003 BootkitT1564.001 Hidden Files and DirectoriesT1564.003 Hidden WindowT1684.001 Impersonation

Defence Impairment

T1685.005 Clear Windows Event Logs

Credential Access

T1003 OS Credential DumpingT1003.001 LSASS MemoryT1003.003 NTDST1040 Network SniffingT1056.001 KeyloggingT1110 Brute ForceT1110.001 Password GuessingT1110.003 Password SprayingT1528 Steal Application Access TokenT1557.004 Evil Twin

Discovery

T1040 Network SniffingT1057 Process DiscoveryT1083 File and Directory DiscoveryT1120 Peripheral Device Discovery

Lateral Movement

T1021.002 SMB/Windows Admin SharesT1091 Replication Through Removable MediaT1210 Exploitation of Remote ServicesT1550.001 Application Access TokenT1550.002 Pass the Hash

Collection

T1005 Data from Local SystemT1025 Data from Removable MediaT1039 Data from Network Shared DriveT1056.001 KeyloggingT1074.001 Local Data StagingT1074.002 Remote Data StagingT1113 Screen CaptureT1114.002 Remote Email CollectionT1119 Automated CollectionT1213 Data from Information RepositoriesT1213.002 SharepointT1557.004 Evil TwinT1560 Archive Collected DataT1560.001 Archive via Utility

Command & Control

T1001.001 Junk DataT1071.001 Web ProtocolsT1071.003 Mail ProtocolsT1090.002 External ProxyT1090.003 Multi-hop ProxyT1092 Communication Through Removable MediaT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1573.001 Symmetric Cryptography

Exfiltration

T1030 Data Transfer Size LimitsT1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1567 Exfiltration Over Web Service

Impact

T1498 Network Denial of Service

Toolsets (29)

🐛

ADVSTORESHELL S0045

Malware · Windows

🐛

CHOPSTICK S0023

Malware · Windows, Linux

🐛

CORESHELL S0137

Malware · Windows

🐛

Cannon S0351

Malware · Windows

🐛

DealersChoice S0243

Malware · Windows

🐛

Downdelph S0134

Malware · Windows

🐛

Drovorub S0502

Malware · Linux

🐛

Fysbis S0410

Malware · Linux

🐛

HIDEDRV S0135

Malware · Windows

🐛

JHUHUGIT S0044

Malware · Windows

🐛

Komplex S0162

Malware · macOS

🐛

LAMEHUG S9035

Malware · Windows

🐛

LoJax S0397

Malware · Windows

🐛

OLDBAIT S0138

Malware · Windows

🐛

USBStealer S0136

Malware · Windows

🐛

XAgentOSX S0161

Malware · macOS

🐛

XTunnel S0117

Malware · Windows

🐛

Zebrocy S0251

Malware · Windows

🐛

reGeorg S1187

Malware · Network Devices, Windows, macOS, Linux

🔧

Forfiles S0193

Tool

🔧

Koadic S0250

Tool · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Responder S0174

Tool

🔧

Tor S0183

Tool · Linux, Windows, macOS

🔧

Wevtutil S0645

Tool · Windows

🔧

Winexe S0191

Tool

🔧

certutil S0160

Tool · Windows

🔧

cipher.exe S1205

Tool · Windows

CVEs Referenced (3 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

CVE-2017-0176View full details on NVD

References & Reports (27)

↑