# Apt28 Fancy Bear

> Adversary-emulation profile for APT28 (G0007 / Fancy Bear / Forest Blizzard / Sofacy / STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.

- Skill: `purpleailab/apt28-fancy-bear` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/apt28-fancy-bear`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/apt28-fancy-bear/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/apt28-fancy-bear

---


# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM) — Adversary Emulation Profile

APT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and — since 2022 — Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.

## Attribution & motivation

- **Sponsor / nation:** Russian Federation — GRU 85th GTsSS, Military Unit 26165. The 2018 U.S. DOJ indictments named specific GRU officers of Units 26165 and 74455; the UK, EU, and France have formally attributed multiple campaigns to this unit.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Russian state interests — military, diplomatic, and political intelligence. Secondary motivations include **influence / information operations** (hack-and-leak against the 2016 U.S. election, WADA athlete data dumps) and occasional **destructive / disruptive** action (TV5Monde disruption, WADA DDoS).
- **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments and coordinated government attributions (UK NCSC, EU, France ANSSI/MFA) plus consistent named vendor reporting (Microsoft, Mandiant, Palo Alto Unit 42, ESET).

## Targeting

- **Sectors:** Government and diplomatic bodies; defense, military, and aerospace; **logistics, transport, and IT/technology firms supporting aid to Ukraine** (since 2022); think tanks, NGOs, and political organizations/campaigns; media; anti-doping (WADA, USADA) and chemical-weapons bodies (OPCW, Spiez); critical infrastructure and energy.
- **Regions:** NATO and allied states — heavy focus on Ukraine, Western/Eastern Europe (notably Germany, France, Poland, the Baltics), North America, and international organizations.
- **Victim profile:** High-value strategic targets — individuals and orgs whose mailboxes, credentials, and documents yield military, political, or diplomatic intelligence. Frequently targets webmail (Outlook/OWA, Roundcube, Yahoo/Google) and edge/network devices as footholds.

## Notable campaigns

- **2015-04 — TV5Monde disruption.** French broadcaster's 11 channels and online presence knocked offline behind a false "CyberCaliphate" hacktivist persona; French investigators and infrastructure overlap tied it to APT28. (securityaffairs / Wikipedia background)
- **2015 — German Bundestag intrusion.** Compromise of the German federal parliament network; the UK later sanctioned GRU Unit 26165 officers for it. (gov.uk)
- **2016 — U.S. election interference (DNC / DCCC / Clinton campaign).** Spearphishing and credential theft, lateral movement DCCC→DNC, and hack-and-leak. Detailed in the July 2018 DOJ/Mueller indictment of 12 GRU officers. (justice.gov / FBI)
- **2014-2018 — WADA / USADA / OPCW / Spiez.** Remote and close-access ("Wi-Fi") operations against anti-doping and chemical-weapons bodies, including a 2016 DDoS and leak of athlete medical data; charged in the October 2018 DOJ indictment of seven GRU officers. (justice.gov / NPR)
- **2018 — LoJax UEFI rootkit.** ESET documented the first in-the-wild UEFI rootkit, used by APT28 for firmware-level persistence surviving OS reinstall. (MITRE software S0397 / ESET)
- **2022-2025 — Western logistics & tech targeting (aid to Ukraine).** Joint CISA advisory **AA25-141A**: password spraying, spearphishing, Outlook NTLM coercion (CVE-2023-23397), Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and WinRAR (CVE-2023-38831) against logistics/IT firms and IP-camera networks. (CISA AA25-141A)
- **2023 — Outlook NTLM (CVE-2023-23397) exploitation.** Zero-click NTLM-hash theft via crafted Outlook calendar reminders; documented by Microsoft and Unit 42 ("Fighting Ursa"). (microsoft.com / unit42)
- **2024-04 — GooseEgg / Print Spooler (CVE-2022-38028).** Microsoft disclosed APT28's custom GooseEgg launcher abusing Windows Print Spooler for SYSTEM-level privilege escalation; CISA added the CVE to the KEV catalog. (microsoft.com)
- **2023-04 — Cisco router operations.** Joint CISA/NCSC advisory **AA23-108** on APT28 exploiting SNMP weaknesses (CVE-2017-6742) to deploy "Jaguar Tooth" and conduct reconnaissance on Cisco IOS routers. (CISA AA23-108)
- **2025-04/07 — France formal attribution.** France's MFA/ANSSI publicly attributed a decade of intrusions against French entities (incl. TV5Monde lineage and government/defense targets) to APT28. (diplomatie.gouv.fr)

## TTPs by ATT&CK tactic

### Initial Access
- **T1566.001** — Spearphishing attachments: weaponized Office docs and RAR archives (incl. WinRAR CVE-2023-38831).
- **T1598.003** — Spearphishing links for credential harvesting (fake login pages on Blogspot, lookalike webmail).
- **T1204.001 / T1204.002** — User execution of malicious links and macro-laden files.
- **T1190** — Exploit public-facing apps: Exchange (CVE-2020-0688, CVE-2020-17144), Roundcube CVEs, SQLi.
- **T1189** — Drive-by compromise via custom exploit kits / XSS.
- **T1133** — External remote services: VPN/Tor fronting for brute-force and access.
- **T1199** — Trusted relationship: pivoted from DCCC to DNC network.
- **T1669** — Wi-Fi networks: "close-access" exploitation of open/nearby Wi-Fi (incl. "nearest-neighbor" pivots).
- **T1078 (implied)** — Valid accounts obtained via spraying/phishing reused for access.

### Execution
- **T1059.001 / .003 / .004 / .005 / .006** — PowerShell, Windows cmd/batch, Unix shell (Drovorub), VBScript (Koadic), Python (reGeorg, LAMEHUG).
- **T1047** — WMI via Koadic and the LAMEHUG implant.
- **T1203** — Exploitation for client execution (CVE-2017-0262 in Office).
- **T1569.002** — Service execution via Net/Koadic.
- **T1221** — Template injection: Word docs pulling remote weaponized templates.

### Persistence
- **T1547.001** — Registry Run keys / Startup folder.
- **T1037.001** — Logon script via `UserInitMprLogonScript`.
- **T1137.002** — Office Test persistence.
- **T1546.015** — COM hijacking (MMDeviceEnumerator).
- **T1542.003** — Bootkit (Downdelph) and **LoJax UEFI rootkit** (firmware persistence).
- **T1547.004 / .005 / .006 / .013** — Winlogon Helper DLL (Cannon), SSP, Linux kernel modules (Drovorub), XDG autostart (Fysbis).
- **T1543.001 / .002 / .003** — macOS Launch Agent (Komplex), Linux systemd (Fysbis), Windows service (JHUHUGIT).
- **T1505.003** — Web shell (reGeorg on OWA).
- **T1574.001** — DLL hijacking (Downdelph).

### Privilege Escalation
- **T1068** — Exploitation for privesc: CVE-2014-4076, CVE-2015-1701, CVE-2015-2387, CVE-2017-0263, and **CVE-2022-38028 (Print Spooler, via GooseEgg)**.
- **T1548.002** — UAC bypass (Koadic, Downdelph).
- **T1134.001 / .005** — Token impersonation (CVE-2015-1701 → SYSTEM) and SID-History injection (Mimikatz).

### Defense Evasion
- **T1027 / .002 / .011 / .013** — Obfuscation: base64/XOR/RC4, software packing (Zebrocy), fileless storage (CHOPSTICK), encrypted/encoded files.
- **T1036 / .005** — Masquerading: renamed WinRAR, file-extension and location spoofing.
- **T1070.004 / .006** — File deletion (CCleaner) and timestomping.
- **T1112** — Registry modification (LoJax).
- **T1218.005 / .010 / .011** — Mshta/Regsvr32 (Koadic), Rundll32 (CHOPSTICK).
- **T1553.004** — Install root certificate via certutil.
- **T1564.001 / .003 / .004** — Hidden files, hidden PowerShell windows (`-WindowStyle Hidden`), NTFS attribute hiding (LoJax).
- **T1497** — Sandbox/VM evasion (CHOPSTICK).
- **T1202** — Indirect command execution via Forfiles.

### Credential Access
- **T1110.001 / .003** — Password guessing and **large-scale password spraying** (reconstituted spray infra, Tor/VPN-fronted).
- **T1557.001** — NBT-NS/LLMNR poisoning (Responder).
- **T1187 / CVE-2023-23397** — **Forced NTLM authentication / coercion** via crafted Outlook reminders to capture Net-NTLM hashes.
- **T1003.001 / .002 / .003 / .004 / .006** — LSASS dump, SAM via `reg save`, NTDS via ntdsutil/VSS, LSA secrets, DCSync (Mimikatz).
- **T1555.003 / .004** — Browser credential theft (XAgentOSX, Zebrocy, OLDBAIT), Windows Credential Manager.
- **T1056.001** — Keylogging.
- **T1528** — Steal application access tokens via OAuth apps masquerading as Google/Yahoo.
- **T1098.002** — Add mailbox delegate / ApplicationImpersonation permissions via PowerShell (Exchange).
- **T1558.001 / .002** — Golden/Silver Kerberos tickets (Mimikatz).
- **T1606** — Forge web credentials (phishing pages).
- **T1552.001** — Credentials in files (XTunnel).

### Discovery
- **T1087.001 / .002** — Local/domain account enumeration (Net, LAMEHUG).
- **T1083** — File/directory discovery (Forfiles for PDF/Office docs).
- **T1046 / T1135 / T1018** — Network service, share, and remote-system discovery (Koadic, Net, Zebrocy).
- **T1016 / .002** — Network config and **Wi-Fi interface discovery** (for close-access ops).
- **T1518.001** — Security software discovery (CHOPSTICK, netsh).
- **T1482** — Domain trust discovery (LAMEHUG).
- **T1201** — Password policy discovery (Net).
- **T1082** — System information discovery (many families).

### Lateral Movement
- **T1021.001 / .002 / .004** — RDP, SMB/admin shares, SSH (via reGeorg tunnel).
- **T1550.002** — Pass-the-hash.
- **T1210** — Exploitation of remote services (SMB RCE).

### Collection
- **T1114.002** — Remote email collection from Exchange/OWA mailboxes.
- **T1213.002** — Data from SharePoint repositories.
- **T1005 / T1039 / T1025** — Local system, network-share, and removable-media collection.
- **T1119** — Automated collection (publicly available tools on DCCC/DNC; USBStealer; LAMEHUG).
- **T1113** — Screen capture (Cannon, XAgentOSX, Zebrocy).
- **T1056.001** — Keylogging for collection.
- **T1602** — Data from network devices (Cisco router config via SNMP).
- **T1560.001** — Archive via WinRAR (password-protected) / PowerShell `Compress-Archive`.
- **T1074.001 / .002** — Local staging (e.g., `C:\ProgramData`, `pi.log`) and remote staging on OWA server.

### Command & Control
- **T1071.001 / .003** — Web (HTTP/S) and mail protocols (IMAP/POP3/SMTP via Google Mail) for C2.
- **T1102.002** — Bidirectional C2 over Google Drive web service.
- **T1568.002** — DGA (CHOPSTICK).
- **T1008** — Fallback channels (CHOPSTICK, JHUHUGIT, XTunnel).
- **T1090.001 / .003** — Internal proxy (`netsh portproxy`) and multi-hop proxy (Tor/VPN).
- **T1572 / T1095** — Protocol tunneling (reGeorg) and non-application-layer protocols (Drovorub).
- **T1573.001 / .002** — Symmetric and asymmetric encrypted channels.
- **T1105** — Ingress tool transfer.

### Exfiltration
- **T1041** — Exfil over C2 channel.
- **T1048.002** — Exfil over alternate protocol: HTTPS via compromised OWA server.
- **T1567** — Exfil over web service (Google Drive).
- **T1030** — Data transfer size limits (split archives into <1MB chunks).
- **T1052.001 / T1020** — Automated USB exfiltration (USBStealer) for air-gap bridging.

### Impact
- **T1561.001** — Disk content wipe via `cipher.exe`.
- **T1498** — Network DoS (2016 DDoS against WADA).

## Signature tooling & malware

| Name | ATT&CK ID | Type | Public/Custom |
|---|---|---|---|
| CHOPSTICK / X-Agent | S0023 | Modular Windows implant (DGA, fileless) | Custom |
| JHUHUGIT / Seduploader | S0044 | First-stage Windows implant | Custom |
| ADVSTORESHELL | S0045 | Backdoor with custom archiving | Custom |
| XTunnel | S0117 | Network proxy/tunnel | Custom |
| CORESHELL / Sofacy | S0137 | Windows downloader/backdoor | Custom |
| Downdelph | S0134 | Delphi backdoor + bootkit | Custom |
| LoJax | S0397 | **UEFI rootkit** (firmware persistence) | Custom |
| Drovorub | S0502 | Linux malware suite + kernel rootkit | Custom |
| Fysbis | S0410 | Linux backdoor | Custom |
| Komplex / XAgentOSX | S0162 / S0161 | macOS trojan / implant | Custom |
| X-Agent for Android | S0314 | Android surveillance | Custom |
| Zebrocy | S0251 | Multi-stage downloader/collector | Custom |
| Cannon | S0351 | Backdoor with email-based exfil | Custom |
| OLDBAIT | S0138 | Credential stealer | Custom |
| USBStealer | S0136 | USB/air-gap exfil | Custom |
| GooseEgg | (no ATT&CK software ID assigned) | Print Spooler privesc launcher (CVE-2022-38028) | Custom |
| LAMEHUG | S9035 | LLM-assisted post-compromise implant | Custom |
| reGeorg | S1187 | Web shell / SOCKS tunnel | Public (Living-off-tooling) |
| Koadic | S0250 | Post-exploitation framework | Public |
| Mimikatz | S0002 | Credential dumping | Public |
| Responder | S0174 | LLMNR/NBT-NS poisoning | Public |
| Tor | S0183 | Anonymity / proxy | Public |
| Net / netsh / certutil / Wevtutil / Forfiles | S0039 / S0108 / S0160 / S0645 / S0193 | LOLBins | Built-in |

> Note: "GooseEgg" is a Microsoft-attributed custom tool; it is **not** the same as ATT&CK software S1145 (Pikabot), so no false software ID is assigned here.

## Emulation guidance (Decepticon)

> **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run destructive (T1561/T1498) or firmware (LoJax-style) actions outside an explicitly sanctioned, isolated lab.

Map APT28's signature plays to Decepticon's own capabilities:

- **Initial access — credential ops (T1110.003, T1598.003, T1566.001).** Use the phishing/credential-harvest skill to stand up lookalike webmail login pages; drive **slow, low-and-slow password spraying** (~few attempts/account/hour) against in-scope OWA/M365 endpoints, fronted through rotating egress to mimic Tor/VPN spray infra. Stage macro/RAR lures with the payload-builder; if WinRAR is in scope, emulate CVE-2023-38831 archive lures.
- **NTLM coercion (T1187 / CVE-2023-23397, T1557.001).** With the AD/lateral-movement skill, run **Responder** for LLMNR/NBT-NS poisoning and emulate Outlook-reminder NTLM coercion to capture Net-NTLM hashes, then relay or crack offline. This is APT28's defining 2023-2025 play — prioritize it.
- **Privilege escalation (T1068, T1548.002).** Use the privesc/defense-evasion skill to emulate **GooseEgg-style Print Spooler abuse (CVE-2022-38028)** for SYSTEM in a patched-vs-unpatched lab, and UAC bypass chains analogous to Koadic/Downdelph.
- **Credential access (T1003.*, T1558.*, T1550.002).** Drive the AD skill / **Mimikatz** for LSASS dump, DCSync, golden/silver tickets, and pass-the-hash — mirroring APT28's domain-takeover pattern.
- **C2 (T1071.001, T1102.002, T1090, T1572).** Use **Sliver** (c2 skill) over HTTPS as the primary channel; add a **mail-protocol or Google-Drive web-service profile** to emulate Cannon/Drive C2, and chain `netsh portproxy` internal proxies + reGeorg-style web-shell tunneling for pivoting.
- **Cloud / token theft (T1528, T1098.002, T1114.002, T1213.002).** With the cloud/M365 skill, emulate OAuth-app consent abuse, ApplicationImpersonation/delegate-permission grants, and bulk mailbox + SharePoint collection.
- **Collection & exfil (T1560.001, T1030, T1048.002, T1567).** Use bash/PowerShell to archive with password-protected RAR/`Compress-Archive`, **split into <1MB chunks**, and exfil over HTTPS through a compromised OWA-equivalent or a web service to reproduce the signature exfil pattern.
- **Edge devices (T1602, T1133).** Where routers/IP cameras are in scope, emulate SNMP/credential weaknesses (cf. AA23-108) to recon network-device config — APT28 favors edge footholds.

## Detection & defense

- **NTLM coercion / CVE-2023-23397:** Patch Outlook; block outbound SMB (TCP 445) and WebDAV at the perimeter; add high-value users to the **Protected Users** group; hunt for Exchange messages with `PidLidReminderFileParameter` UNC paths; alert on outbound NTLM to external hosts.
- **Password spraying (T1110.003):** Enforce **phishing-resistant MFA**; alert on distributed low-rate auth failures across many accounts from rotating/Tor/VPN IPs; disable legacy/basic auth on M365/OWA; monitor impossible-travel and new-ASN sign-ins.
- **Print Spooler / GooseEgg (CVE-2022-38028):** Apply Oct-2022+ patches; disable the Spooler where not needed; monitor for `spoolsv.exe` spawning cmd/PowerShell and writes to Spooler driver/JS-constraints paths.
- **Credential dumping (T1003.*):** Enable LSA protection (RunAsPPL) and Credential Guard; alert on LSASS handle access, `ntdsutil`/`vssadmin` shadow-copy creation, and `reg save` of SAM/SYSTEM/SECURITY; monitor DCSync replication from non-DC accounts.
- **OAuth/delegation abuse (T1528, T1098.002):** Audit enterprise app consent and mailbox `Add-MailboxPermission`/ApplicationImpersonation role grants; restrict user consent; review delegate/forwarding rules.
- **Web shells & tunneling (T1505.003, T1572, T1090.001):** Monitor OWA/IIS directories for new aspx/script files (reGeorg); alert on `netsh interface portproxy add`; baseline web-server child processes.
- **Persistence (T1547, T1137.002, T1542.003):** Monitor Run keys, `UserInitMprLogonScript`, Office Test registry keys; deploy Secure Boot + firmware integrity (against LoJax-class UEFI implants).
- **Edge/network devices (T1602):** Replace default SNMP community strings, restrict SNMP to management VLANs, patch Cisco IOS (cf. CVE-2017-6742), and monitor for unexpected config reads (Jaguar Tooth pattern).
- **Exfiltration (T1030, T1048.002, T1567):** DLP/egress monitoring for chunked password-protected archives and uploads to Google Drive / unusual HTTPS endpoints, especially staged from mail servers.

## Sources

- https://attack.mitre.org/groups/G0007/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/
- https://www.justice.gov/archives/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and
- https://www.fbi.gov/news/stories/russian-gru-officers-charged-with-hacking-100418
- https://www.gov.uk/government/news/uk-enforces-new-sanctions-against-russia-for-cyber-attack-on-german-parliament
- https://www.diplomatie.gouv.fr/en/country-files/russia/news/2025/article/russia-attribution-of-cyber-attacks-on-france-to-the-russian-military
- https://attack.mitre.org/software/S0397/