Glossary term
Zero-day vulnerability
A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.
Read more
Significant cyber incident
APT28 attacks on French entities and French attribution, 2025
In short
On 29 April 2025 France's foreign ministry formally said that Russia's military intelligence service (GRU) used the APT28 attack group to target or compromise a dozen French entities since 2021. They include public services, private companies and a sport organization involved in the 2024 Olympic and Paralympic Games. The French cyber agency ANSSI published a technical report the same day.
What happened
On 29 April 2025 the French Ministry for Europe and Foreign Affairs said that Russia’s military intelligence service, the GRU, used the APT28 attack group behind several cyber attacks on French interests. Since 2021 the group had been used to target or compromise a dozen French entities.
The ministry said these include public services, private enterprises and a sport organization involved in the 2024 Olympic and Paralympic Games. It also said the same group was used by the GRU in the sabotage of TV5Monde in 2015 and in attempts to destabilize the 2017 French elections.
On the same day ANSSI, the national cyber agency, published report CERTFR-2025-CTI-007. It says the campaigns ran from 2021 to 2024 and aimed to gather strategic intelligence. In 2024 victims included governmental, diplomatic and research entities. The report counts as a “target” any attempt at compromise, whether or not it worked.
Timeline
-
2015
The GRU uses APT28 in the sabotage of TV5Monde, according to the French foreign ministry (statement of 29 April 2025).
-
2017
APT28 is used in attempts to destabilize the French elections (foreign ministry).
-
2021
Campaigns linked to APT28 begin to target or compromise French entities (ANSSI, CERT-FR).
-
26 October 2023
CERT-FR publishes a report on APT28 campaigns since 2021, with recommendations.
-
2024
French governmental, diplomatic and research entities are the main victims of APT28-linked campaigns (CERT-FR).
-
29 April 2025
The foreign ministry attributes the attacks to the GRU and APT28 and says a dozen French entities were targeted or compromised.
-
29 April 2025
CERT-FR publishes report CERTFR-2025-CTI-007, "Targeting and compromise of French entities using the APT28 intrusion set".
How the attack worked
Getting in
ANSSI says the APT28 operators start with phishing campaigns, exploit vulnerabilities (including a zero-day) and run brute-force attacks, notably against webmail. It also found that attackers compromised edge devices, such as routers, VPNs, e-mail gateways and firewalls, which are generally poorly supervised. This lowers the risk of detection. Phishing is cataloged as Phishing (T1566) and password guessing as Brute Force (T1110) on attack.mitre.org.
Examples of campaigns
ANSSI describes repeated attacks on Roundcube e-mail servers, using phishing e-mails to deliver exploitation kits that exfiltrate mailbox contents and find new targets. In 2023 phishing links led to a domain on a free hosting service that delivered ZIP archives with the HeadLace backdoor. Other campaigns sent users of UKR.NET and Yahoo to fake login pages to steal their login details.
Quiet, cheap infrastructure
The report says the operators rely on low-cost, ready-to-use outsourced infrastructure from reconnaissance to exfiltration, such as rented servers, free hosting and VPN services. These services are also used legitimately, which makes them harder to track.
Goal
The report says the aim is to collect strategic intelligence from France, Europe, Ukraine and North America. Some campaigns only grab conversations, address books and login details and leave no lasting access.
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the French Ministry for Europe and Foreign Affairs, 29 April 2025: Russia's military intelligence service (GRU) used the APT28 attack group; it mentions GRU Unit 20728 for operations against Ukraine.
CERT-FR (ANSSI), 29 April 2025: the attackers are publicly linked to the Russian Federation.
The ministry also noted that the EU imposed sanctions on people and entities responsible for attacks conducted with the help of this group.
Impact
Scale: about a dozen French entities targeted or compromised since 2021 (foreign ministry, 29 April 2025). ANSSI counts both attempted and successful compromises as "targeting" and "compromise" and does not give a split in the text opened.
Sectors: ministerial entities, local governments and administrations, defense industrial base, aerospace, research and think tanks, and economic and financial organizations (ANSSI).
Sport: a sport organization involved in the 2024 Olympic and Paralympic Games (foreign ministry).
No data volumes, financial losses or disruptions are stated in the sources opened.
Government and regulator response
- 26 October 2023: CERT-FR published a report on APT28 campaigns since 2021, with technical details and recommendations.
- 29 April 2025: the foreign ministry condemned the GRU’s use of APT28, called the activity contrary to UN norms of responsible state behavior, and said France would use all means to anticipate, discourage and respond to such behavior.
- 29 April 2025: ANSSI and its C4 partners published CERTFR-2025-CTI-007 to help prevent future attacks.
Lessons
-
Edge devices are targets
ANSSI found poorly supervised routers, VPNs, gateways and firewalls compromised to lower detection risk. Inventory, patch and monitor them.
-
Webmail is a main door
Phishing and brute force against webmail start the chain. Use strong sign-in and watch for guessing and odd logins.
-
Espionage can leave little behind
Some campaigns only collect conversations, address books and logins and leave no lasting access (ANSSI). Do not rely on finding malware alone.
-
Cheap services hide the attacker
The operators use rented servers and free services also used by normal people. Block or alert on unusual use of free hosting and temporary mail services.
-
Public attribution takes years
The activity runs from 2021 and the attribution came in April 2025. Keep logs long enough to look back.
-
Sport and public bodies are in scope
Victims included a sport body linked to the 2024 Games, so event partners should be treated as targets.
What to check in your own organization
-
Edge device inventory
List routers, VPNs, mail gateways and firewalls, confirm patch state and who watches their logs.
-
Webmail protection
Require multi-factor sign-in and alert on repeated failed logins and logins from new places.
-
Mail server updates
Patch webmail servers such as Roundcube promptly and limit who can reach them from the internet.
-
Phishing handling
Run phishing drills with fake sign-in pages and fast reporting for staff.
-
Free service use
Review traffic to free hosting and web-hook style services that staff do not normally use.
-
Log retention
Keep authentication and mail logs for a long enough period to answer questions about activity from years ago.
-
Read the ANSSI report
Compare the report's campaign descriptions with your own detections and add the recommendations of October 2023 to your plan.
Where it happened
- Country France France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games. Europe
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
Who did France blame?
On 29 April 2025 the foreign ministry said Russia's military intelligence service (GRU) used the APT28 attack group.
How many French entities were hit?
About a dozen were targeted or compromised since 2021, per the foreign ministry. ANSSI counts failed attempts as targeting.
Which sectors were affected?
ANSSI lists ministries, local governments, defense industry, aerospace, research and think tanks, and economic and financial entities. The ministry also names a sport organization linked to the 2024 Olympic and Paralympic Games.
How do the attackers get in?
According to ANSSI, through phishing, exploited vulnerabilities and brute-force attacks on webmail, and through poorly supervised edge devices.
Is this linked to earlier French cases?
The ministry said APT28 was also used in the 2015 TV5Monde sabotage and in attempts to destabilize the 2017 French elections.
Where can I read the technical report?
On the CERT-FR site as CERTFR-2025-CTI-007, published 29 April 2025.
In our research
- APT28 Threat group
Sources
- Russia - Attribution of cyber attacks on France to the Russian military intelligence service (APT28) Ministry for Europe and Foreign Affairs of France
- Targeting and compromise of French entities using the APT28 intrusion set (CERTFR-2025-CTI-007, page) CERT-FR, ANSSI
- Targeting and compromise of French entities using the APT28 intrusion set (PDF) CERT-FR, ANSSI
- Campagnes d'attaques du mode opératoire APT28 depuis 2021 (CERTFR-2023-CTI-009) CERT-FR, ANSSI
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.