Log in Request a demo

Threat group profile

APT28

Also known as Fancy Bear, Forest Blizzard, Sofacy

The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165).

In short

The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). MITRE says the group has been active since at least 2004, and government advisories describe espionage against governments, militaries, political parties, media and logistics firms.

Last updated 7 October 2026

Profile MapThreat Group
  1. Attributed OriginRussia
  2. Names15names in public reportsAPT28 · Fancy Bear · Forest Blizzard
  3. Sectors9named as targetsGovernment and military · Political parties · Defense industry and aerospace
  4. Techniques12in the attack chainReconnaissance · Initial Access · Credential Access
  5. Tools7tools and malware listedCHOPSTICK · XTunnel · Zebrocy

In one minute

Who they are
Governments attribute APT28 to Russia's military intelligence (GRU), unit 26165. The US (2018 indictments), the UK (2018, 2024, 2025), the EU (2020 sanctions listing) and Czechia (2024) have said so publicly.
Who they target
Government and military bodies, defense firms, political parties, media, energy, logistics and IT firms, think tanks and anti-doping bodies, mostly in Europe, North America and Ukraine, according to CISA, NCSC, DOJ and CERT-FR.
How they usually get in
Password guessing and spraying against email and cloud logins, phishing links to fake login pages, known flaws in mail software such as Outlook, and hacked routers, as described in government advisories.
What stands out
The US and UK describe hacked small-office routers used to hide activity (2023, 2024, 2026) and close-access Wi-Fi attacks by officers who traveled abroad (US indictment, 2018).
What to do first
Turn on multi-factor authentication for email, VPN and cloud logins, patch mail and edge systems, and make sure routers and gateways do not expose their management pages to the internet.

Names

Public reports use several names for this activity.

Names used for APT28
NameWhere it appears
APT28 MITRE ATT&CK group G0007[1]
Fancy Bear MITRE ATT&CK; UK 2018 statement; EU Council decision 2020/1537[1, 5, 7]
Forest Blizzard MITRE ATT&CK[1]
Sofacy MITRE ATT&CK; EU Council decision 2020/1537 ("Sofacy Group")[1, 7]
Sednit MITRE ATT&CK; US DOJ, February 2024[1, 12]
Pawn Storm MITRE ATT&CK; US DOJ, February 2024 (written "Pawnstorm" in the UK 2018 statement)[1, 5, 12]
STRONTIUM MITRE ATT&CK[1]
Tsar Team MITRE ATT&CK; UK 2018 statement[1, 5]
Threat Group-4127 (TG-4127) MITRE ATT&CK[1]
IRON TWILIGHT MITRE ATT&CK[1]
SNAKEMACKEREL MITRE ATT&CK[1]
Swallowtail MITRE ATT&CK[1]
Group 74 MITRE ATT&CK[1]
GruesomeLarch MITRE ATT&CK[1]
FROZENLAKE MITRE ATT&CK; CERT-FR report (also lists UAC-0028)[1, 15]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Group page, modified 31 July 2026

    Says APT28 "has been attributed to" the GRU 85th Main Special Service Center, military unit 26165, and has been active since at least 2004.[1]

  • US Department of Justice 13 July 2018

    Charged 12 GRU officers over the 2016 hacking of the Clinton campaign, the DCCC and the DNC. Unit 26165 is alleged to have done the spearphishing and hacking, and Unit 74455 to have helped release the stolen documents.[2]

  • US Department of Justice 4 October 2018

    Charged seven GRU officers, five of them assigned to Unit 26165, over hacking of anti-doping bodies and a US energy firm and the April 2018 close-access operation against the OPCW in The Hague.[3]

  • UK Foreign Office and NCSC 4 October 2018

    Said the GRU was responsible for a series of attacks, including the 2016 DNC hack and the 2018 attempt on the OPCW, and listed APT 28, Fancy Bear, Sofacy, Sednit, Pawnstorm and Tsar Team among the names the GRU operates under.[5, 6]

  • US Treasury 19 December 2018

    Designated nine GRU officers of Units 26165 and 74455 under CAATSA section 224.[4]

  • EU Council 22 October 2020

    Listed two persons and the 85th Main Centre for Special Services (GTsSS), also known as military unit 26165, under EU cyber sanctions. The decision cites the 2015 Bundestag attack and the 2018 OPCW attempt.[7]

  • NSA, CISA, FBI and UK NCSC 1 July 2021

    Joint advisory on a global brute force campaign attributed to the GRU 85th GTsSS, active from at least mid-2019.[9, 10]

  • UK Government 3 May 2024

    Said APT28 is part of Russia's GRU, and joined Germany, the EU and Czechia in condemning an attack on the German SPD that used Outlook flaws.[13]

  • Czech Ministry of Foreign Affairs 3 May 2024

    Said the way Czech bodies were attacked in 2023 through an Outlook flaw "matched the profile of the actor APT28", a Russian state-controlled actor linked to military intelligence.[14]

  • ANSSI (CERT-FR) 2025

    Report on APT28 targeting of French entities from 2021 to 2024. Calls the intrusion set "publicly attributed to the Russian Federation".[15]

  • NSA, FBI, UK NCSC and other agencies May 2025

    Joint advisory on GRU 85th GTsSS military unit 26165 targeting Western logistics and technology companies.[16]

  • UK Government and NCSC 18 July 2025

    Said AUTHENTIC ANTICS malware is attributed to APT 28, part of the GRU 85th Main Special Service Center, military unit 26165. Sanctioned GRU units 26165, 29155 and 74455 and 18 individuals.[17]

  • UK NCSC 7 April 2026

    Assessed that APT28 is "almost certainly" GRU 85th GTsSS military unit 26165, in an advisory on router DNS hijacking.[18]

Where sources differ

Sources differ on units. MITRE ties APT28 to unit 26165. The US indictment of 13 July 2018 and the Treasury designations of 19 December 2018 put the 2016 election operation across two units, 26165 and 74455. The UK list of 4 October 2018 names APT 28 and Sandworm together among names it ties to the GRU, while the UK in July 2025 lists Units 26165 and 74455 separately and says 74455 is known as Sandworm. The US Department of Justice pages give unit numbers; the name 85th GTsSS comes from MITRE, the EU decision, CISA and NCSC.

Who they target

Sectors

  • Government and militaryNCSC lists government and military among sectors hit by the brute force campaign. CERT-FR: ministries and local governments in France from 2021.[10, 15]
  • Political partiesDOJ: the Clinton campaign, the DCCC and the DNC in 2016. UK: an attack on the German SPD.[2, 13]
  • Defense industry and aerospaceCISA: defense contractors. CERT-FR: defense and aerospace organizations in France.[15, 16]
  • Logistics and transportCISA: dozens of entities across air, sea and rail, including ports, airports and air traffic management.[16]
  • IT and technology firmsCISA: IT services and technology companies involved in delivering aid to Ukraine.[16]
  • EnergyNCSC: energy companies in the brute force campaign. CERT-FR: energy. DOJ: a US energy firm.[3, 10, 15]
  • MediaNCSC: media in the brute force campaign. UK 2018: a UK television station's email accounts in 2015.[5, 10]
  • Sport and anti-doping bodiesDOJ: the World Anti-Doping Agency, the US Anti-Doping Agency and others.[3]
  • Think tanks and researchNCSC: think tanks in the brute force campaign. CERT-FR: research institutions and think tanks.[10, 15]

Regions

  • UkraineCISA: Ukrainian entities and cameras at Ukrainian border crossings. CERT-FR: Ukraine-related entities. NCSC: about 250 Ukrainian victims of the 2021 router attacks.[11, 15, 16]
  • Europe and NATO membersCISA: dozens of entities across NATO member states and Ukraine. NCSC: organizations in Europe in 2021.[11, 16]
  • United StatesDOJ: US political and sporting bodies. NCSC: US government institutions in the 2021 router attacks.[2, 3, 11]
  • Germany, Czechia and FranceEU: the 2015 Bundestag attack. Czechia: 2023 attacks through an Outlook flaw. CERT-FR: French entities from 2021 to 2024.[7, 14, 15]
  • United KingdomOn 18 July 2025 the UK government said the sanctioned GRU units ran a sustained malicious cyber campaign over many years, including in the UK. It says Russia has targeted UK media, telecoms, political and democratic institutions and energy infrastructure.[24]
  • GermanyThe Federal Government said on 3 May 2024 that APT28 ran a campaign against the SPD executive committee and German authorities and companies, and attributed it to the GRU. It also said APT28 is responsible for the 2015 Bundestag attack.[25]
  • FranceOn 29 April 2025 France's foreign ministry said the GRU used APT28 to target or compromise a dozen French entities since 2021, including public services, private companies and a sport organization involved in the 2024 Games.[26]
  • NetherlandsThe joint advisory AA25-141A, published with the Dutch MIVD, lists the Netherlands among countries with entities targeted by GRU unit 26165, commonly known as APT28, in a campaign against Western logistics and technology companies.[16]
  • PolandThe joint advisory AA25-141A lists Poland among countries with targeted entities in a campaign by Russian military intelligence unit 26165, commonly known as APT28; Poland was 4.0% of targeted IP camera attempts. CERT Polska says APT28 also exploited CVE-2024-42009 against Polish entities in 2025.[16]
  • RomaniaThe SRI said on 8 April 2026 it took part in Operation Masquerade against a router network used by APT28, attributed to the GRU, and that the actor compromised entities including in Romania, mainly critical infrastructure and military and government information.[27]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2004

    Earliest activity reported by MITRE

    MITRE says the group has been active since at least 2004.[1]

  2. Apr to May 2015

    Bundestag attack

    The EU Council decision says officers of the 85th GTsSS took part in a cyber-attack on the German federal parliament.[7]

  3. 2015

    UK television station emails

    The UK says the GRU was responsible for access to the email accounts of a small UK television station.[5]

  4. 2016

    US election hacks

    DOJ alleges Unit 26165 spearphished the Clinton campaign and hacked the DCCC and DNC, and that Unit 74455 helped release the data.[2]

  5. Aug 2016

    Anti-doping data theft

    DOJ alleges GRU officers captured an IOC official's credentials over Wi-Fi in Rio and reached the WADA ADAMS database.[3]

  6. 2018

    Foreign Office and OPCW attempts

    The UK says the GRU tried to compromise the UK Foreign Office and the OPCW by spearphishing.[5]

  7. Apr 2018

    Officers in The Hague

    DOJ alleges four GRU officers traveled to The Hague for a close-access operation against the OPCW's Wi-Fi.[3]

  8. From mid-2019

    Global brute force campaign

    NSA, CISA, FBI and NCSC say the campaign ran from at least mid-2019 against many sectors.[9, 10]

  9. 2021

    Cisco router attacks

    NCSC says attacks in 2021 hit organizations in Europe, US government bodies and about 250 Ukrainian victims.[11]

  10. 2021 to 2024

    French targets

    CERT-FR says APT28 targeted or compromised French entities in this period.[15]

  11. Feb 2022 to Nov 2024

    Nearest Neighbor campaign

    MITRE dates this campaign from February 2022 to November 2024.[1]

  12. Since 2022

    Logistics and technology firms

    CISA says unit 26165 has targeted Western logistics and technology companies since 2022.[16]

  13. Feb 2024

    Router network disrupted

    DOJ announced a court-authorized operation against hundreds of Ubiquiti routers used by unit 26165.[12]

  14. Since 2024

    Router DNS hijacking

    NCSC says APT28 has hijacked router DNS settings since 2024 and into 2026 to steal passwords and tokens.[18]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT28
DateWhoWhat
13 Jul 2018 US Department of Justice Indictment12 GRU officers from Units 26165 and 74455 charged over 2016 election hacking and releases.[2]
4 Oct 2018 US Department of Justice IndictmentSeven GRU officers charged, five of them from Unit 26165, over anti-doping hacking, close-access operations and the OPCW attempt.[3]
4 Oct 2018 UK Foreign Office and NCSC AttributionNamed the GRU as responsible for several attacks and named Unit 26165 in the OPCW case.[5, 6]
19 Dec 2018 US Treasury SanctionsNine GRU officers designated.[4]
13 Aug 2020 NSA and FBI AdvisoryDisclosed the Drovorub malware, attributed to Russian APT actors.[8]
22 Oct 2020 EU Council SanctionsListed two persons and the 85th GTsSS under EU cyber sanctions.[7]
1 Jul 2021 NSA, CISA, FBI, NCSC AdvisoryJoint advisory on the GRU brute force campaign, with mitigations.[9, 10]
18 Apr 2023 NCSC with NSA, CISA, FBI AdvisoryWarning about APT28 exploiting poorly maintained Cisco routers.[11]
15 Feb 2024 US Department of Justice Court-authorized disruptionCopied and deleted malicious files on hundreds of routers and blocked remote management access.[12]
3 May 2024 UK Government and Czech Ministry of Foreign Affairs Public attributionEach condemned APT28 and tied it to the GRU.[13, 14]
2025 ANSSI (CERT-FR) Threat reportReport on APT28 targeting of French entities, 2021 to 2024.[15]
May 2025 NSA, FBI, NCSC and other agencies AdvisoryJoint advisory on GRU unit 26165 targeting logistics and technology firms.[16]
18 Jul 2025 UK Government and NCSC Sanctions and attributionSanctioned GRU units 26165, 29155 and 74455 and 18 individuals, and attributed AUTHENTIC ANTICS to APT28.[17]
7 Apr 2026 UK NCSC AdvisoryAPT28 exploiting routers for DNS hijacking, with mitigations.[18]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Phishing for Information: Spearphishing Link T1598.003

    Sends links that lead to fake login pages that capture credentials.[1, 16]

Resource Development

  • Compromise Infrastructure: Network Devices T1584.008

    Compromised small-office routers to collect credentials and hide activity.[1, 12, 18]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    Sends emails with malicious attachments.[1]

  • Exploit Public-Facing Application T1190

    Exploits known flaws in mail and web systems, including the Outlook flaw CVE-2023-23397.[1, 14, 16]

  • Valid Accounts T1078

    Logs in with stolen or default credentials.[1]

Persistence

  • Account Manipulation: Additional Email Delegate Permissions T1098.002

    Granted extra access to mailboxes for sustained email collection.[1]

Privilege Escalation

  • Exploitation for Privilege Escalation T1068

    Has exploited local privilege-escalation flaws on victim machines.[1]

Credential Access

  • Brute Force: Password Spraying T1110.003

    Tries a few passwords across many accounts, using Tor and commercial VPNs to hide where the attempts come from.[1, 9, 16]

  • Brute Force: Password Guessing T1110.001

    Used a Kubernetes cluster for large-scale password guessing.[1, 9]

  • Adversary-in-the-Middle: Evil Twin T1557.004

    Used Wi-Fi attacks to capture credentials.[1, 3]

  • OS Credential Dumping: NTDS T1003.003

    Tried to dump Active Directory databases once inside a network.[1]

Collection

  • Email Collection: Remote Email Collection T1114.002

    Collected email from victim mail servers.[1]

Tools and malware

  • CHOPSTICK Backdoor

    A family of modular backdoors used by APT28 since at least 2012, with Windows and Linux variants (MITRE).[19]

  • XTunnel Network proxy tool

    A VPN-like proxy that relays traffic between a command server and a victim, reportedly used in the 2016 DNC breach (MITRE).[23]

  • Zebrocy Trojan

    Used since at least November 2015, with variants in several programming languages (MITRE).[22]

  • LoJax UEFI rootkit

    Used to keep remote access software on targeted systems (MITRE).[21]

  • Drovorub Linux malware toolset

    An agent, client, server and kernel modules. NSA and FBI disclosed it in August 2020.[8, 20]

  • Jaguar Tooth Router malware

    Deployed on some Cisco routers in 2021 for unauthenticated access, as described by NCSC.[11]

  • AUTHENTIC ANTICS Credential and token stealer

    Shows fake login prompts and intercepts OAuth tokens for Microsoft accounts, per the UK Government and NCSC.[17]

Also linked in our threat library:

Detection and defense

  1. Use multi-factor authentication

    Turn on multi-factor authentication for email, VPN and cloud logins first. NCSC and CISA name it as the main defense against the brute force and credential theft campaigns.

    Counters T1110.003 T1110.001 T1078

  2. Patch mail, router and edge systems

    Apply security updates for Outlook, mail servers, routers and other edge devices as soon as they are out.

    Counters T1190 T1068 T1584.008

  3. Keep router and gateway management private

    Never expose management interfaces to the internet, and monitor routers for changed settings.

    Counters T1584.008

  4. Disable NTLM where you can

    CISA advises disabling NTLM and applying patches immediately.

    Counters T1190 T1557.004

  5. Watch mailbox permission changes

    Alert on new mailbox delegate permissions and on bulk reading of mail through the server.

    Counters T1098.002 T1114.002

  6. Segment the network and watch for credential dumping

    Network segmentation limits what a stolen account can reach. Watch for attempts to dump Active Directory data.

    Counters T1003.003 T1078

  7. Monitor use of administration tools

    CISA advises monitoring for suspicious use of legitimate Windows administration tools.

    Counters T1078

  8. Teach staff to report fake login pages

    Tell staff how to report suspicious messages and links without fear of blame.

    Counters T1598.003 T1566.001

What Brandefense can do

Questions

Who is APT28?

The US, UK, EU and Czech governments attribute it to the GRU 85th Main Special Service Center, military unit 26165. MITRE says it has been active since at least 2004.

Are they still active?

Government publications say so. CISA's logistics advisory is dated May 2025. The UK NCSC published an advisory on 7 April 2026 saying APT28 has hijacked router DNS settings since 2024.

Who do they target?

According to CISA, NCSC, DOJ and CERT-FR: governments, militaries, defense firms, political parties, media, energy, logistics and IT firms, think tanks and anti-doping bodies, mainly in Europe, North America and Ukraine.

How do they get in?

Per the advisories: password guessing and spraying, phishing links to fake login pages, known flaws such as the Outlook flaw CVE-2023-23397, hacked routers, and in 2016 close-access Wi-Fi attacks by officers abroad (US indictment).

How can I tell if I am a target?

CISA says logistics and technology firms involved in delivering aid to Ukraine face elevated risk. The sources give no test. Check for repeated failed logins from changing addresses and unexpected mailbox permission changes.

What should I do first?

Turn on multi-factor authentication for email, VPN and cloud logins, patch mail and edge systems, secure routers, and monitor mailbox permission changes, as NCSC and CISA advise.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. ATT&CK groups by attributed origin: what is mapped October 2026
  3. ATT&CK techniques most used across threat groups October 2026
  4. How to triage a leaked password alert October 2026
  5. Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026
  6. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  7. APT28: Russia’s Persistent Cyber Espionage Arm November 2025
  8. APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse September 2025

Sources

  1. APT28 (G0007) MITRE ATT&CK Supports: Unit attribution, active since 2004, names, techniques, software, Nearest Neighbor dates
  2. Grand Jury Indicts 12 Russian Intelligence Officers for Hacking Offenses Related to the 2016 Election US Department of Justice Supports: July 2018 indictment, Units 26165 and 74455
  3. U.S. Charges Russian GRU Officers with International Hacking and Related Influence and Disinformation Operations US Department of Justice Supports: October 2018 indictment, anti-doping bodies, OPCW, Rio Wi-Fi
  4. Treasury Targets Russian Operatives over Election Interference, World Anti-Doping Agency Hacking, and Other Malign Activities US Department of the Treasury Supports: Nine GRU officers designated, 19 December 2018
  5. UK exposes Russian cyber attacks UK Foreign Office and NCSC (GOV.UK) Supports: UK attribution of 4 October 2018, list of names, 2015 television station
  6. UK statement on attempted hacking of the OPCW by Russian military intelligence UK Government (GOV.UK) Supports: Unit 26165 named in the OPCW case
  7. Council Decision (CFSP) 2020/1537 of 22 October 2020 Council of the European Union (EUR-Lex) Supports: EU sanctions listing of the 85th GTsSS, the Bundestag attack
  8. Joint NSA and FBI Cybersecurity Advisory Discloses Russian Malware Drovorub CISA Supports: Drovorub disclosure, 13 August 2020
  9. NSA, CISA, NCSC, FBI joint advisory on Russian GRU brute force campaign CISA Supports: Brute force campaign by the GRU 85th GTsSS
  10. NCSC joins US partners to expose global brute force campaign by Russian Intelligence Services UK NCSC Supports: Sectors targeted, start date mid-2019, multi-factor authentication
  11. UK and US issue warning about APT28 actors exploiting poorly maintained Cisco routers UK NCSC Supports: 2021 router attacks, Jaguar Tooth
  12. Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation's Main Intelligence Directorate of the General Staff (GRU) US Department of Justice Supports: Router disruption, 15 February 2024, names Sofacy, Sednit, Pawn Storm
  13. UK joins partners in condemnation of malicious cyber activity by Russian Intelligence Services: UK government statement UK Foreign, Commonwealth and Development Office Supports: UK statement of 3 May 2024
  14. Statement of the MFA on the Cyberattacks Carried by Russian Actor APT28 on Czechia Czech Ministry of Foreign Affairs Supports: Czech attribution, Outlook flaw, 3 May 2024
  15. Targeting and compromise of french entities using the APT28 intrusion set (CERTFR-2025-CTI-007) ANSSI, CERT-FR Supports: French victims 2021 to 2024, sectors, entry methods
  16. Russian GRU Targeting Western Logistics Entities and Technology Companies (AA25-141A) CISA with NSA, FBI, NCSC-UK and partner agencies Supports: Logistics campaign, targets, entry methods, mitigations
  17. UK calls out Russian military intelligence for use of espionage tool UK NCSC Supports: AUTHENTIC ANTICS, UK sanctions of 18 July 2025
  18. APT28 exploit routers to enable DNS hijacking operations UK NCSC Supports: Router DNS hijacking advisory, attribution, mitigations
  19. CHOPSTICK (S0023) MITRE ATT&CK Supports: CHOPSTICK description
  20. Drovorub (S0502) MITRE ATT&CK Supports: Drovorub description
  21. LoJax (S0397) MITRE ATT&CK Supports: LoJax description
  22. Zebrocy (S0251) MITRE ATT&CK Supports: Zebrocy description
  23. XTunnel (S0117) MITRE ATT&CK Supports: XTunnel description
  24. UK sanctions Russian spies at the heart of Putin's malicious regime UK Government (FCDO) Supports: Names United Kingdom as a target
  25. Attribution of a Russian cyber campaign Federal Government of Germany Supports: Names Germany as a target
  26. Russia - Attribution of cyber attacks on France to the Russian military intelligence service (APT28) Ministry for Europe and Foreign Affairs of France Supports: Names France as a target
  27. SRI a contribuit alaturi de comunitatea internationala la stoparea unor atacuri cibernetice atribuite GRU Romanian Intelligence Service (SRI) Supports: Names Romania as a target

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Government and public sector

State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.

Read more

Role

SOC and CTI analyst

Give every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.

Read more