🇺🇸 United States🇺🇦 Ukraine🇩🇪 Germany🇫🇷 France🇬🇧 United Kingdom🇵🇱 Poland🇬🇪 Georgia🏳️ NATO Members
Overview
APT28 (also tracked as Fancy Bear, Forest Blizzard, STRONTIUM, Pawn Storm, Sednit, and Sofacy) is a Russian military intelligence (GRU) cyber espionage group attributed to Unit 26165 of the 85th Main Special Service Center (GTsSS). Active since at least 2004, APT28 conducts intelligence collection aligned with Russian military and geopolitical objectives. The group is known for sophisticated spearphishing campaigns, zero-day exploitation, and credential harvesting operations targeting government, military, defense, political organizations, media, and anti-doping agencies across NATO member states and former Soviet countries. APT28 gained widespread public attention for its role in the 2016 US presidential election interference, including the DNC breach and subsequent hack-and-leak operations. In recent years, the group has expanded targeting to Western logistics and technology companies supporting Ukraine, as documented in the May 2025 joint advisory (CISA AA25-141A). The group demonstrates sustained evolution in tradecraft, including the development of custom exploit tools (GooseEgg), novel access techniques (Nearest Neighbor Wi-Fi attack), and webmail exploitation campaigns (Operation RoundPress).
Detect outbound SMB connections initiated by Outlook calendar processing. Monitor for Windows Event ID 4648 (logon with explicit credentials) to external IPs. Alert on UNC path access from outlook.exe. KQL: DeviceNetworkEvents | where InitiatingProcessFileName == 'outlook.exe' and RemotePort == 445
Monitor for processes accessing lsass.exe memory. Sysmon Event ID 10 with TargetImage containing lsass.exe and GrantedAccess of 0x1010 or 0x1038. Deploy Credential Guard where possible. Sigma rule: sysmon_cred_dump_lsass_access.
Monitor svchost.exe (spoolsv) spawning unexpected child processes like cmd.exe or powershell.exe. Track file modifications in C:\Windows\System32\spool\drivers\. Microsoft published specific detection guidance for GooseEgg exploitation.
Monitor for WMI spawning powershell.exe with encoded arguments. Sysmon Event ID 1 with ParentImage wmiprvse.exe. Elastic detection rule: command_and_scripting_interpreter_via_wmi.
Monitor for Outlook spawning script interpreters or making outbound SMB connections. ASR rule: Block Office applications from creating executable content. Elastic rule: microsoft_365_exchange_transport_rule_creation.
Monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run for new entries. Sysmon Event ID 13 (Registry value set). Sigma rule: registry_set_asep_reg_keys_modification_currentversion.