CISA advisory AA25-141A, released in May 2025 and last revised on April 17, 2026, describes a Russian state-sponsored espionage campaign against Western logistics entities and technology companies. The advisory is joint work by the NSA, FBI, CISA and many partner agencies. It says the campaign targeted dozens of entities, mixed known techniques, and has run for over two years. This note summarizes that one document and nothing else.
Who published the advisory, and who does it blame?
The advisory lists the NSA, the FBI, the UK NCSC and agencies from Germany, the Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France and the Netherlands as authors and co-sealers. It also names CISA, the US Department of Defense Cyber Crime Center and US Cyber Command.
The campaign is attributed by these agencies to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, military unit 26165. The advisory adds that the cybersecurity community knows this unit as APT28, Fancy Bear, Forest Blizzard and BlueDelta. It also warns that vendor groupings may not be a 1:1 match with the US government view. Our profile of APT28 covers the group name in more depth.
Who was targeted, and why?
The advisory says the campaign hit government and private entities across “virtually all transportation modes: air, sea, and rail”. The verticals it lists, in NATO member states, Ukraine and international organizations, are defense industry, transportation and transportation hubs, maritime, air traffic management and IT services.
The stated reason is aid to Ukraine. The advisory says that as Western countries provided aid, the unit “expanded its targeting of logistics entities and technology companies involved in the delivery of aid”. It describes the campaign as cyber espionage. The countries with targeted entities, as the advisory lists them, are Bulgaria, the Czech Republic, France, Germany, Greece, Italy, Moldova, the Netherlands, Poland, Romania, Slovakia, Ukraine and the United States.
After a first compromise, the actors looked for businesses tied to the victim and used those trust links to try to reach more access. The advisory also says they scouted a maker of railway ICS components, but “a successful compromise was not confirmed”.
How did the intrusions run?
The advisory gives initial access methods, then post-compromise steps, persistence and exfiltration. The flow below follows its own MITRE ATT&CK ids.
- Initial accessCredential guessing, spearphishing, or the listed CVEsTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- ReconnaissanceContacts, transport coordinators, partner companiesTechnique T1589.002 (MITRE ATT&CK, opens in a new tab)
- Lateral movementImpacket, PsExec and RDPTechnique T1021.001 (MITRE ATT&CK, opens in a new tab)
- Credential theftDump the Active Directory NTDS.dit databaseTechnique T1003.003 (MITRE ATT&CK, opens in a new tab)
- PersistenceMailbox permission changes, scheduled tasks, run keysTechnique T1098.002 (MITRE ATT&CK, opens in a new tab)
- Collection and exfiltrationZip archives, then upload or periodic EWS queriesTechnique T1560 (MITRE ATT&CK, opens in a new tab)
- CleanupDelete event logs with wevtutilTechnique T1070.001 (MITRE ATT&CK, opens in a new tab)
What were the initial access methods?
The advisory lists credential guessing (T1110.001), brute force (T1110.003), spearphishing for credentials and for malware (T1566), and exploitation of Internet-facing systems such as corporate VPNs (T1133, T1190). It also says SOHO devices were abused to proxy activity (T1665).
Password guessing ran through Tor and commercial VPNs (T1090.003), with frequently rotated addresses and TLS (T1573). Spearphishing used links (T1566.002) to fake login pages that imitated government bodies and Western cloud email providers. Some chains checked the visitor’s location and browser, and relayed MFA and CAPTCHA prompts. The actors also sent malware, named in the advisory as HEADLACE and MASEPIE. One attempt used voice phishing (T1566.004) while posing as IT staff. Learn more about phishing as a technique and about brute force attacks.
Which vulnerabilities does the advisory list?
- CVE-2023-23397, an Outlook NTLM flaw, used to collect NTLM hashes through crafted calendar invitations (T1187).
- CVE-2020-12641, CVE-2020-35730 and CVE-2021-44026, Roundcube flaws used to run shell commands and read email (T1059, T1114).
- CVE-2023-38831, a WinRAR flaw used “since at least fall 2023” through malicious archives (T1659).
Exposed remote access is part of the list too, so the page on external remote services is a useful companion.
What did the actors do inside the network?
They used native commands and open source tools, including Impacket and PsExec, to move sideways, and RDP (T1021.001). They tried to dump the NTDS.dit database (T1003.003) with ntdsutil, and used Certipy and ADExplorer.exe against Active Directory. They also used Get-GPPPassword.py (T1552.006) and a modified ldap-dump.py for enumeration and a password spray over LDAP.
For persistence the advisory names mailbox permission abuse (T1098.002), MFA enrollment of compromised accounts (T1556.006), scheduled tasks (T1053.005), run keys (T1547.001) and startup shortcuts (T1547.009). Data was zipped (T1560, T1560.001) and moved through OpenSSH (T1048), or pulled from mail servers through EWS and IMAP (T1114.002), with periodic EWS queries (T1119). The advisory says long gaps between exfiltration and the use of local infrastructure allowed collection to go undetected.
The accounts they wanted held shipment data. The advisory lists sender, recipient, vehicle numbers, route and cargo contents for aid shipments.
What period does the campaign cover?
The advisory says the campaign has run “for over two years” and that logistics and IT firms have faced elevated risk “since 2022”. The dated events it gives are below.
- Late February 2022Russian state cyber actors widen operationsUnit 26165 is described as mainly involved in espionage.
- March 2022IP camera campaign beginsRTSP servers hosting cameras, mostly in Ukraine, were targeted as early as this month.
- Fall 2023WinRAR flaw in useCVE-2023-38831 is used “since at least fall 2023”.
- June to August 2024Brute forcing IP addressesThe advisory lists addresses dating from these months.
- May 2025Initial publicationThe advisory first appears.
- April 2026CorrectionTwo domains in the blocking list are corrected.
What about the IP cameras?
The advisory says the actors “likely” used camera access near border crossings, military sites and rail stations to track the movement of materials into Ukraine. From a sample of more than 10,000 targeted cameras, it reports this spread by country.
| Country | Share of attempts |
|---|---|
| Ukraine | 81.0% |
| Romania | 9.9% |
| Poland | 4.0% |
| Hungary | 2.8% |
| Slovakia | 1.7% |
| Others | 0.6% |
What does the advisory recommend?
The advisory tells defenders to presume targeting and to hunt for the listed techniques and IOCs. Its own recommendations include:
- Use MFA with strong factors such as passkeys or smartcards, and prefer account throttling to lockout.
- Block or alert on logins from public VPNs, and on NTLM and SMB requests to external hosts.
- Plan to disable NTLM, and do not store passwords in Group Policy Preferences.
- Alert on or block the hosting and API mocking services it lists, with exceptions for legitimate use.
- Watch for unexpected log clearing, and restrict script execution to known scripts.
- For IP cameras: patch, drop unsupported devices, disable remote access if unneeded, and change default credentials.
The same style of advisory appears in our notes on AA24-038A and AA24-109A. For one technique the advisory shows in detail, see credential dumping.
Limits of this note
We read one advisory text and added no outside data. It gives no victim count beyond “dozens of entities”. It says specific IOCs may no longer be actor controlled, and that the unit almost certainly uses infrastructure not listed. Attribution is the advisory’s, not ours.