APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[14] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[15] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
93
TechniquesTop 1%
15
TacticsTop 1%
29
Tools & malwareTop 2%
1
Campaignunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.16
APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.2021 They have also dumped the LSASS process memory using the MiniDump function.22
During APT28 Nearest Neighbor Campaign,APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: reg save hklm\sam, reg save hklm\system, and reg save hklm\security.23
Credential Accessvia an attributed campaign only36 detection rules
APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.26272829
Collection22 detection rules
Standing G0007
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques93Top 1%
99th percentile · 99% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics15Top 1%
100th percentile · None of the 176 ATT&CK groups has more tactics spanned — the highest in the population.
Tools & malware29Top 2%
98th percentile · 98% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaign189% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique7medBottom 17%
17th percentile · 83% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique1medBottom 22%
22nd percentile · 78% of 176 ATT&CK groups have more atomic tests per technique.
Data comps / technique4med65% tie · 12 values
65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique2med43% tie · 11 values
43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 93 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-01
—
248649b7-d64f-46f0-9fb2-a52774166fb5
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-01
—
55695bc0-c8cf-461f-a379-2535f563c854
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.