APT28 (also Fancy Bear, Sofacy and Sednit) is a Russian cyber espionage group that MITRE ATT&CK says has been active since at least 2004. The US, UK and EU attribute it to the GRU’s 85th Main Special Service Center (military unit 26165). Czechia (May 2024) also links it to the GRU.
| Also known as | Fancy Bear, Forest Blizzard, Sofacy, Sednit, Pawn Storm, STRONTIUM |
| Attributed to | Russia's GRU, 85th Main Special Service Center, military unit 26165 |
| Attributed by | The US, UK and EU; Czechia (May 2024) links it to the GRU |
| Active since | At least 2004 (MITRE ATT&CK) |
| MITRE ATT&CK ID | G0007 |
| Main targets | Government, military, defense, political parties, media, energy and logistics, mostly in Europe, North America and Ukraine |
Full sources, timeline and government actions are in the APT28 threat group profile.
Introduction
APT28 is also known as Fancy Bear, Sofacy, Sednit, STRONTIUM and various other names. It is the most recognizable and longest-running advanced persistent threat (APT) group still in existence. APT28 is the tip of the spear of Russian state-affiliated cyber capabilities. APT28 has been traced back as far as 2004. National intelligence organizations assess with high confidence that the group is affiliated with the Russian military intelligence service (GRU, Unit 26165). For twenty years, APT28 has been involved in a leading role in cyber-espionage, political interference, and hybrid warfare as part of global issues. The group has consistently targeted NATO, the European Union, the United States and international organizations that counter Russian interests. Its direct effects have been aligned with Moscow at a geopolitical level.
This blog explores APT28’s identity, tactics, tools and operational behavior. It also covers how the group has developed into 2025, the strategic implications and lessons for defenders.
Who Is APT28 and What Motivates It?
APT28 is believed to be part of the Russian General Staff Main Intelligence Directorate (GRU), specifically Unit 26165. Its long history of operations shows a consistent alignment with Russian state interests. These include intelligence collection, political influence and undermining opponents’ institutions.
APT28’s motivations include espionage and influencing political outcomes and destabilizing adversaries, through the use of both disinformation and information warfare. APT28’s known roles in election interference campaigns show its value to the Kremlin. It is an espionage asset and also a tool for Russia’s strategic influence objectives.
Aliases: Fancy Bear, Sofacy, STRONTIUM, Sednit, Tsar Team, Pawn Storm.
Active Since: At least 2004.
Motivation: Its motives include political and military espionage as well as election interference and influence operations that directly support Russian state policy.
- Aliases.
- Fancy Bear, Sofacy, STRONTIUM, Sednit, Tsar Team, Pawn Storm.
- Active since.
- At least 2004.
- Attributed to.
- Russian military intelligence (GRU), Unit 26165, assessed with high confidence by national intelligence organizations.
- Motivation.
- Political and military espionage, election interference and influence operations.
- Sectors.
- Government, defense, military, transportation, non-governmental organizations, media, critical infrastructure.
- Geographies.
- Primarily NATO countries, Ukraine, EU members and North America.
TTPs (Tactics, Techniques & Procedures)
APT28 has shown extensive adaptability, utilizing both advanced zero-day exploits as well as extended periods of low-level access. Its tradecraft is characterized by flexible and scaleable operations, that could be utilized against a wide array of targets.
Initial Access
– Spear-phishing with attachments or links to malicious content.
– Exploitation of zero day vulnerabilities for widely used software platforms (MS Outlook, MS Office and Windows-like components).
– Credential theft and brute-force attacks.
Persistence
– The use of custom implants like Sednit and Zebrocy.
– The use of scheduled tasks and registry changes.
– Compromised credentials allowing long-lasting access.
Command and Control (C2)
– Custom malware families which have encrypted C2 communications.
– Compromised servers and dynamic DNS infrastructure.
– Covert communications channels embedded in trusted services.
Malware and Tools
– X-Agent: Modular implant designed for Windows, Linux, and iOS.
– Sednit/Sofacy loader.
– Zebrocy Trojan for credential harvesting and reconnaissance.
– Backdoors such as Chopstick and GameFish.
– Exploitation frameworks that have been positioned against Outlook vulnerabilities.
Techniques
– Credential harvesting and password spraying.
– Lateral movement throughout enterprise networks.
– Supply chain compromises to gain access to trusted ecosystems.
– Data exfiltration at scale.
– Coordinated disinformation and hack-and-leak operations.
- Initial accessSpear-phishing, zero-day exploits, credential theft and brute force
- PersistenceCustom implants such as Sednit and Zebrocy, scheduled tasks, registry changes
- Command and controlEncrypted C2, compromised servers, dynamic DNS infrastructure
- Lateral movementMovement throughout enterprise networks
- Data exfiltrationData theft at scale
Who Does APT28 Target?
APT28’s targeting mirrors the Russian geopolitical agenda and military interests.
- Sectors: Government, defense, military, transportation, non-governmental organizations, media, sectors designated as critical infrastructure.
- Geographies: Primarily NATO countries, Ukraine, members of the EU, North America, and entities associated towards outcomes that counter Russian interests.
APT28’s breadth in targeting showcases this as a multi-mission intelligence service rather than a single-purpose cyber espionage agent.
Notable Operations
APT28 has been associated with some of the most significant cyber events of the last decade. All of them coincided with key geopolitical operations by Russia.
- 2016Interference in the U.S. Presidential ElectionInfiltrated political party networks and exfiltrated emails.
- 2017Targeting of European electionsAttempted to penetrate French election campaigns and German political organizations.
- 2018Doping investigation espionageTargeted organizations investigating the Russian state-sponsored doping issue.
- 2020COVID-19 vaccine espionageSpear-phishing and intrusion operations against vaccine research facilities in Europe and North America.
- 2022Ukraine invasion supportTargeted NATO defense ministries, Ukrainian infrastructure and media.
- 2023Email exploit campaignsExploited vulnerabilities in email platforms against European governments.
- 2024 to 2025Outlook exploits against NATO and EUTargeted Czech, German and NATO government institutions.
2016: Interference in the U.S. Presidential Election
APT28 infiltrated political party networks, exfiltrated emails, and facilitated the release of the emails to interfere in the outcome of the U.S. presidential election.
2017: Targeting of European elections
APT28 attempted to penetrate French election campaigns and German political organizations. The aim was to influence political outcomes and undermine faith in democratic institutions.
2018: Doping Investigation Espionage
APT28 targeted organizations investigating the Russian state-sponsored doping issue. It exfiltrated sensitive data to diminish the credibility of international oversight organizations.
2020: COVID-19 Vaccine Espionage
APT28 conducted spear-phishing and intrusion operations against vaccine research facilities in Europe and North America to steal proprietary medical research.
2022: Ukraine Invasion Support
APT28 initiated aggressive activity inline with Russia’s invasion of Ukraine, targeting NATO defense ministries, Ukrainian infrastructure, and media. These operations involved a combination of espionage and disinformation aimed at undercutting Western support for the efforts in Kyiv.
2023: Email Exploit Campaigns
APT28 exploited vulnerabilities in email platforms to spy on European governments. This shows the group’s ongoing interest in diplomatic and political intelligence.
2024–2025: Outlook Exploits Against NATO and EU
Most recently, APT28 has exploited Microsoft Outlook vulnerabilities to target Czech, German and NATO government institutions. It continues its longstanding espionage campaigns with updated methods.
More APT28 operations, 2015 to 2021
Alongside its election interference, APT28 ran a long series of phishing and exploit campaigns from 2015 to 2021 against parliaments, NATO members, defense companies and foreign ministries.
- 2015German BundestagIntrusion into the parliament’s network in April and May 2015; the EU sanctioned Russian military intelligence officers for it in 2020.
- 2015EFF spoof, White House and NATOJava 0-day and a copy of the EFF domain name.
- 2016Pawn Storm adds TurkeyTurkish parliament and Prime Ministry added to its target list.
- Late 2016 to early 2017DealersChoice phishingFlash exploit documents sent to defense and foreign ministries, with lures about NATO and Turkish troops in Mosul.
- 2018Foreign affairs bodies in Europe and North AmericaPhishing email titled “Upcoming Defense events February 2018”.
- 2019Middle East defense companiesTheir compromised email accounts sent credential phishing; Exchange Autodiscover servers probed to brute force logins.
- 2020Zebrocy in a NATO-themed campaignDelphi version with a low detection rate.
- 2021MSHTML exploitationDefense and national security policy officials in Western Asia; OneDrive used for command and control. Attributed to APT28 with moderate confidence by Trellix.
Recent Developments (2024–2025)
APT28 is still extremely active, launching campaigns against Western government networks. The exploitation of Microsoft Outlook vulnerabilities underscores the group’s continued ability to weaponize software flaws at scale. Its use of zero-days, in addition to credential theft and social engineering, guarantees continuing effectiveness, even while defensive measures are strengthened. In October 2026, Symantec reported that APT28 used the HOOKEDGE backdoor against defense firms and a law enforcement agency in two NATO countries. Our analysis of the 2026 HOOKEDGE campaign covers the attack chain.
Reports also indicate that disinformation operations support the technical intrusions, amplifying narratives to Moscow’s advantage, while also creating division among NATO allies. It remains a key aspect of Russian doctrine to conduct cyber espionage operations and information warfare in concert.
Strategic Impact
APT28 presents one of the most substantial and continuous cyber threats around the world. Its operations have:
- Undermined trust in democratic processes through election interference.
- Assisted Russian military operations by targeting NATO and Ukrainian targets.
- Threatened critical infrastructure via espionage and preparation for intrusions.
- Blended cyber intrusions and disinformation for mutual strategic effect.
The group’s operations signal a blurring of the lines between espionage and influence operations in modern conflict. In that setting, data theft, leaks and propaganda can work together to achieve the objectives of the state.
How Can Organizations Defend Against APT28?
Protecting against APT28 requires resilience and is a measured tactic:
- Quickly patch critical vulnerabilities, especially if it concerns enterprise tools like Outlook and Office that are widely deployed.
- Use multi-factor authentication. This greatly helps degradation of credential theft.
- Monitor for anomalous logons, privilege escalations, and data exfiltration.
- Harden email gateways with advanced filtering and sandboxing.
- Share threat intelligence with allied organizations to identify campaigns early.
- Provide staff training on spear-phishing and credential stealing tactics.
Although APT28 is an exceptionally capable adversary, monitoring APT28 more proactively and expediting incident response can raise the cost of an intrusion.
Conclusion
APT28 exemplifies a state-directed exercise of cyber power that carries a high degree of both technical sophistication and strategic intent. Over more than two decades, APT28 has shaped global perceptions of Russia’s cyber capabilities. It has carried out distinctive, high-profile operations and has consistently adapted to defensive measures. APT28’s persistence makes it very likely it will remain relevant within the global threat landscape in 2025 and beyond.
For organizations in NATO, the EU, and allied nations, vigilance against APT28 is not a possibility; it is a necessity. APT28’s behavior clearly shows that it is not just an espionage actor. It is also a weapon the Russian state uses in its competition with the West. As the world remains susceptible to strategic competition, APT28 remains a sharpened digital spear for Moscow.
You can download and review the sheet for all the details!
