CVE Intelligence
Início / Grupos de ameaça / APT28

APT28 G0007

🔔 Criar alerta

Também conhecido como: IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

7
CVEs associadas
110
Técnicas
29
Malwares e ferramentas

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004.

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2022-38028 Alta · 7.8 KEV Microsoft Windows Print Spooler Privilege Escalation Vulnerability
“APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”
CVE-2017-0263 Alta · 7.8 KEV Microsoft Win32k Privilege Escalation Vulnerability
“APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”
CVE-2017-0262 Alta · 7.8 KEV Microsoft Office Remote Code Execution Vulnerability
“APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.”
CVE-2015-4902 Média · 5.3 KEV Oracle Java SE Integrity Check Vulnerability
“APT28 has used CVE-2015-4902 to bypass security features.”
CVE-2015-2387 Alta · 7.8 KEV Microsoft ATM Font Driver Privilege Escalation Vulnerability
“APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”
CVE-2015-1701 Alta · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability
“APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.”
CVE-2014-4076 ainda não publicada aqui
“APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.”

Técnicas por tática

Reconhecimento
T1589.001 CredentialsT1591 Gather Victim Org InformationT1595.002 Vulnerability ScanningT1596 Search Open Technical DatabasesT1598 Phishing for InformationT1598.003 Spearphishing Link
Desenvolvimento de recursos
T1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1584.008 Network DevicesT1586.002 Email AccountsT1588.002 ToolT1588.007 Artificial Intelligence
Acesso inicial
T1078 Valid AccountsT1078.004 Cloud AccountsT1091 Replication Through Removable MediaT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1669 Wi-Fi Networks
Execução
T1059.001 PowerShellT1059.003 Windows Command ShellT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistência
T1037.001 Logon Script (Windows)T1078 Valid AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1133 External Remote ServicesT1137.002 Office TestT1505.003 Web ShellT1542.003 BootkitT1546.015 Component Object Model HijackingT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1037.001 Logon Script (Windows)T1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1134.001 Token Impersonation/TheftT1546.015 Component Object Model HijackingT1547.001 Registry Run Keys / Startup Folder
Furtividade
T1014 RootkitT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1078.004 Cloud AccountsT1134.001 Token Impersonation/TheftT1140 Deobfuscate/Decode Files or InformationT1211 Exploitation for StealthT1218.011 Rundll32T1221 Template InjectionT1542.003 BootkitT1564.001 Hidden Files and DirectoriesT1564.003 Hidden WindowT1684.001 Impersonation
Comprometimento de defesas
T1685.005 Clear Windows Event Logs
Acesso a credenciais
T1003 OS Credential DumpingT1003.001 LSASS MemoryT1003.003 NTDST1040 Network SniffingT1056.001 KeyloggingT1110 Brute ForceT1110.001 Password GuessingT1110.003 Password SprayingT1528 Steal Application Access TokenT1557.004 Evil Twin
Descoberta
T1040 Network SniffingT1057 Process DiscoveryT1083 File and Directory DiscoveryT1120 Peripheral Device Discovery
Movimento lateral
T1021.002 SMB/Windows Admin SharesT1091 Replication Through Removable MediaT1210 Exploitation of Remote ServicesT1550.001 Application Access TokenT1550.002 Pass the Hash
Coleta
T1005 Data from Local SystemT1025 Data from Removable MediaT1039 Data from Network Shared DriveT1056.001 KeyloggingT1074.001 Local Data StagingT1074.002 Remote Data StagingT1113 Screen CaptureT1114.002 Remote Email CollectionT1119 Automated CollectionT1213 Data from Information RepositoriesT1213.002 SharepointT1557.004 Evil TwinT1560 Archive Collected DataT1560.001 Archive via Utility
Comando e controle
T1001.001 Junk DataT1071.001 Web ProtocolsT1071.003 Mail ProtocolsT1090.002 External ProxyT1090.003 Multi-hop ProxyT1092 Communication Through Removable MediaT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1573.001 Symmetric Cryptography
Exfiltração
T1030 Data Transfer Size LimitsT1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1567 Exfiltration Over Web Service
Impacto
T1498 Network Denial of Service

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.