APT28 (Fancy Bear)

Russian military intelligence (GRU unit 26165) espionage group behind the 2016 DNC hack, Outlook zero-click attacks and campaigns against NATO defense and Ukraine aid logistics.

Threat actor profile · Updated Nov 1, 2026

Active: 2004 to October 2026
Origin: Russia (GRU military unit 26165)
Type: State-sponsored
Affiliates: GRU unit 26165 (85th Main Special Service Center); personas DCLeaks and Guccifer 2.0; shares the GRU with Sandworm (unit 74455)
Regions targeted: United States, NATO and EU member states, Ukraine, Georgia and the Caucasus, Central and Eastern Europe, the Balkans, international organizations
MITRE ATT&CK: G0007

What each vendor calls it

Microsoft: Forest BlizzardSTRONTIUM
CrowdStrike: Fancy Bear
Google / Mandiant: APT28
Palo Alto Unit 42: Fighting Ursa
Sophos / Secureworks: IRON TWILIGHTTG-4127Threat Group-4127
Proofpoint: TA422
Kaspersky: Sofacy
ESET: SednitTsar Team
Symantec: Swallowtail
Trend Micro: Pawn Storm
Cisco Talos: Group 74
Recorded Future: BlueDelta
IBM X-Force: ITG05

Also known as APT-C-20 Qihoo 360ATG2ATK5Blue AthenaCrisisFourFROZENLAKEGrey-CloudGrizzly SteppeGroup-4127GruesomeLarchHELLFIRELAKE RELICOperation Pawn StormSIG40SNAKEMACKEREL AccentureT-APT-12UAC-0001 CERT-UAUAC-0028 CERT-UAZ-Lom Team

See this actor in the Threat Actor Rosetta Stone →

Profile

APT28 is one of the longest-running and most heavily documented state hacking groups in the world. The US, UK and several European governments attribute it to the Russian military intelligence service (GRU), specifically military unit 26165, the 85th Main Special Service Center. In July 2018 a US federal grand jury indicted twelve GRU officers, several of them from unit 26165, over the 2016 US election intrusions. The group has been active since at least the mid-2000s; MITRE dates its operations to 2004, and its activity has never stopped for long.

Its mission is classic military-intelligence collection with an occasional influence twist. Targets cluster around what the Russian state cares about at any given moment: NATO governments and militaries, defense contractors, foreign ministries, the Caucasus and Ukraine, election bodies and political parties, and international organizations that have crossed Moscow, including the World Anti-Doping Agency and the Organisation for the Prohibition of Chemical Weapons. In October 2018 the UK’s National Cyber Security Centre publicly tied the GRU to a string of those operations, and the US Justice Department charged seven GRU officers the same day over the anti-doping and OPCW hacks, including a close-access team caught in The Hague with Wi-Fi equipment in the boot of a car.

Initial access has shifted with the times but leans on three habits. First, spearphishing: weaponized Office documents, credential-harvesting pages that imitate webmail and Microsoft 365 logins, and lures themed on whatever is in the news. Second, exploiting internet-facing systems and email software, often fast: the Outlook CVE-2023-23397 flaw (which needed no click at all), the WinRAR CVE-2023-38831 bug within weeks of its patch, and a long run of Roundcube, Zimbra and MDaemon webmail cross-site scripting flaws. Third, brute force and password spraying at scale: an NSA, CISA, FBI and NCSC advisory in 2021 described a Kubernetes cluster used to spray credentials against hundreds of organizations worldwide.

The tooling is broad and long-lived. For years the group’s signature implant was X-Agent (CHOPSTICK, also called Sofacy), with Sedreco, XTunnel and the Zebrocy downloader alongside it. ESET found the group using LoJax, the first UEFI rootkit seen in the wild, in 2018, and the NSA and FBI exposed its Linux rootkit Drovorub in 2020. More recently the group favors small, disposable tools: Microsoft documented GooseEgg, a launcher that abuses a Windows Print Spooler bug for SYSTEM rights, and lightweight backdoors that hide command-and-control traffic in legitimate web services such as webhook.site, Mocky and free hosting.

Two shifts stand out over the last few years. The first is infrastructure: rather than renting servers, the group has hijacked other people’s equipment. In February 2024 the FBI took down a network of compromised Ubiquiti EdgeRouters that APT28 used as a proxy layer and phishing platform. The second is creativity in access. Volexity described a “nearest neighbor” attack in which the group breached organizations near its real target and then hopped onto the target’s Wi-Fi from inside those neighboring buildings, without ever being physically close.

Since Russia’s full-scale invasion of Ukraine, the focus on logistics has sharpened. A May 2025 joint advisory from CISA, the NSA, the FBI and partners in ten countries warned that unit 26165 was targeting Western logistics and technology companies involved in getting aid to Ukraine, including rail, air and maritime transport, and had even accessed IP cameras at border crossings to watch shipments. ThreatRoundup’s own reporting in October 2026 covered a Symantec investigation into the group inside a NATO naval shipbuilder, the same pattern of defense-industrial collection.

Vendors agree on the core identity more than they do for most actors, but the naming is famously messy. Microsoft calls it Forest Blizzard (formerly STRONTIUM), CrowdStrike Fancy Bear, Secureworks IRON TWILIGHT, Proofpoint TA422, ESET and others Sednit, Kaspersky Sofacy, Symantec Swallowtail, Unit 42 Fighting Ursa, Recorded Future BlueDelta and CERT-UA UAC-0001 (full list above).

Events

Date	Target	Narrative	Source	Our coverage
2026-07 to 2026-09	Naval shipbuilder, law enforcement agency and military aircraft engine maker in two NATO countries	Spearphishing Word document drops the HOOKEDGE backdoor, which polls webhook.site through a hidden Edge window; operators tunnel SSH over port 80, capture NTLM handshakes and run a new reflective loader. Symantec tracks the group as Swallowtail.	Symantec	Our story
2025-05	Western logistics and technology companies supporting aid to Ukraine	Joint advisory from 11 countries: credential guessing, spearphishing, Outlook and Roundcube exploitation and VPN flaws against rail, air and maritime logistics firms, plus access to IP cameras at border crossings and rail stations.	CISA AA25-141A
2025-05	Government and defense bodies in Ukraine and Eastern Europe	Operation RoundPress: cross-site scripting flaws in Roundcube, Horde, MDaemon and Zimbra webmail used to steal credentials and email from inside the victim’s own browser session, including an MDaemon zero-day.	ESET
2024-11	US organization working on Ukraine-related projects	“Nearest neighbor” attack: the group compromised organizations in nearby buildings, then used their systems to log on to the target’s Wi-Fi with credentials it had sprayed earlier.	Volexity
2024-04	Government, NGO, education and transportation organizations in Ukraine, Western Europe and North America	Microsoft details GooseEgg, a launcher exploiting the Windows Print Spooler flaw CVE-2022-38028 for SYSTEM privileges and credential theft, in use since at least 2020.	Microsoft
2024-02	Small-office and home routers worldwide	Operation Dying Ember: the FBI disrupts a network of more than a thousand Ubiquiti EdgeRouters, first infected with Moobot by criminals who used default passwords, and then taken over by APT28 to proxy traffic, host phishing pages and harvest credentials.	US Justice Department
2023-10	Users in Ukraine	Google TAG reports APT28 (which it tracks as FROZENLAKE) exploiting the WinRAR flaw CVE-2023-38831 weeks after its patch, using phishing lures that led to free hosting sites.	Google TAG
2023-03	Government, transportation, energy and military organizations in Europe	Microsoft discloses the Outlook elevation-of-privilege flaw CVE-2023-23397, exploited by the group since April 2022: a calendar invite alone leaks the victim’s NTLM hash to an attacker server, no click needed.	Microsoft
2020-08	Linux systems (targets not disclosed)	NSA and FBI expose Drovorub, a Linux kernel rootkit and toolkit attributed to unit 26165, and publish detection guidance.	NSA / FBI
2019 to 2021	Hundreds of government, defense, energy, political and media organizations worldwide	Large-scale brute-force and password-spraying campaign run from a Kubernetes cluster and Tor, followed by exploitation of Exchange flaws and lateral movement.	NSA / CISA / FBI / NCSC
2018-10	World Anti-Doping Agency, OPCW, Westinghouse and others	US charges seven GRU officers; the Dutch government had expelled a close-access team caught near the OPCW in The Hague with Wi-Fi hacking gear. The UK names the GRU behind a series of attacks.	US Justice Department, NCSC
2018-09	Government organizations in the Balkans and Central and Eastern Europe	ESET finds LoJax, a UEFI rootkit that survives operating-system reinstallation and disk replacement, the first seen used in the wild.	ESET
2016	US Democratic National Committee, Democratic Congressional Campaign Committee, Clinton campaign	Spearphishing and X-Agent intrusions; stolen material leaked through the DCLeaks and Guccifer 2.0 personas. Basis of the July 2018 indictment of twelve GRU officers.	US Justice Department
2014-10	Governments and militaries in the Caucasus and Eastern Europe, NATO	FireEye (now Mandiant) publishes the first major public report naming APT28 and linking it to the Russian government.	MITRE ATT&CK (citing FireEye)
2004	Not disclosed	Earliest activity MITRE ATT&CK attributes to the group.	MITRE ATT&CK

Target vectors risk profile

Government	Defense	Diplomatic	Elections	Transportation/logistics	Edge devices/VPNs	Cloud/identity	Energy	Media/journalists	Finance	Ransomware/extortion
High	High	High	High	High	High	High	Medium	Medium	Low	N/A

Malware and tools

Name	What it does	Public detection	Hunt Leads	Reports
HOOKEDGE	Lightweight backdoor that fetches tasks through a hidden Edge window polling webhook.site	Indicators in Symantec’s report	7 Hunt Leads	Symantec
GooseEgg	Launcher exploiting CVE-2022-38028 in Print Spooler for SYSTEM rights, then running follow-on tools	Microsoft Defender detections and hunting queries in Microsoft’s report		Microsoft
Drovorub	Linux kernel rootkit with file transfer, port forwarding and remote shell	Snort rules, YARA rules and Volatility guidance in the advisory		NSA / FBI
LoJax	UEFI rootkit built from a modified copy of the LoJack anti-theft agent	Indicators in ESET’s report		ESET
X-Agent (CHOPSTICK)	Modular backdoor for keylogging, file theft and remote control; the group’s signature implant for about a decade	Community YARA rules in Florian Roth’s signature-base		MITRE ATT&CK
Zebrocy	Downloader and backdoor family, rewritten in several programming languages over the years	Community YARA rules in signature-base		MITRE ATT&CK
Mimikatz, Responder, Impacket	Public tools for credential dumping, NTLM capture and lateral movement	Many published Sigma rules (SigmaHQ)		CISA AA25-141A

Reports

Date	Source	Report
2026-10	Symantec	Swallowtail: Russian espionage group targets NATO naval shipbuilder
2025-05-21	CISA, NSA, FBI and partners	Russian GRU targeting Western logistics entities and technology companies
2025-05-15	ESET	Operation RoundPress
2024-11-22	Volexity	The nearest neighbor attack
2024-04-22	Microsoft	Analyzing Forest Blizzard’s custom post-compromise tool (GooseEgg)
2024-02-15	US Justice Department	Court-authorized disruption of a botnet controlled by the GRU
2023-10-18	Google TAG	Government-backed actors exploiting WinRAR vulnerability
2023-03-24	Microsoft	Guidance for investigating attacks using CVE-2023-23397
2021-07-01	NSA, CISA, FBI, NCSC	Russian GRU conducting global brute force campaign
2020-08-13	NSA, FBI	Russian GRU 85th GTsSS deploys previously undisclosed Drovorub malware
2018-10-04	NCSC (UK)	Reckless campaign of cyber attacks by Russian military intelligence service exposed
2018-10-04	US Justice Department	US charges Russian GRU officers with international hacking
2018-09-27	ESET	LoJax: first UEFI rootkit found in the wild, courtesy of the Sednit group
2018-07-13	US Justice Department	Grand jury indicts 12 Russian intelligence officers

Vulnerabilities exploited

Vulnerability	CVSS	Severity	Publisher	Platform	CISA KEV
CVE-2023-23397	9.8	Critical	Microsoft	Outlook for Windows	Yes
CVE-2023-38831	7.8	High	RARLAB	WinRAR	Yes
CVE-2022-38028	7.8	High	Microsoft	Windows Print Spooler	Yes
CVE-2024-11182	6.1	Medium	MDaemon Technologies	MDaemon Email Server webmail	Yes
CVE-2023-43770	6.1	Medium	Roundcube	Roundcube Webmail	Yes
CVE-2021-44026	9.8	Critical	Roundcube	Roundcube Webmail	Yes
CVE-2020-35730	6.1	Medium	Roundcube	Roundcube Webmail	Yes
CVE-2020-12641	9.8	Critical	Roundcube	Roundcube Webmail	Yes

If you’re in their sights

Do this now

Patch your email servers and webmail first: Exchange and Outlook, Roundcube, Zimbra and MDaemon. This group exploits webmail flaws soon after they’re disclosed, and an unpatched Outlook was enough to leak passwords with no click at all.
Use phishing-resistant MFA (hardware security keys or passkeys) on email, VPN and cloud accounts, and lock out or alert on password-spraying patterns. Much of their access starts with a guessed or phished password.
Block outbound NTLM (SMB on port 445 and WebDAV) to the internet, and watch for workstations talking to webhook.site, Mocky and similar free web services: the group uses them for command and control.
Replace end-of-life routers and change default passwords on edge devices, including Ubiquiti gear and IP cameras. Treat your Wi-Fi as an entry point too: require certificate-based or MFA-protected Wi-Fi logins, not just a password.

Compiled from US, UK and allied government advisories and indictments, Microsoft, ESET, Volexity, Google, Symantec and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 1, 2026.