← All threat actors
APT28G0007 ↗
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.
Motivation
Espionage
Suspected origin
Russian Federation
Reports / IOCs (VT)
755 reports · 2,858 IOCs
Reported activity
2003 – 2026
Targeted industries
GovernmentAerospace & Defense
Targeted regions
FranceHungaryGermanyArmeniaKazakhstanJapanJordanUkrainePolandChinaMongoliaUnited StatesBelgiumUnited KingdomAfghanistanGeorgiaPakistanTajikistanTurkey
Associated malware (39)
ArguePatchBEARDSHELLBadPawCaddyWiperCannonComputraceCoreshellCredoMapDowndelphDownrageDriveOceanFusionDriveGONEPOSTALGooseEggGraphiteKoadicKomplexLAMEHUGLoJaxMASEPIEMocky LNKOCEANMAPOLDBAITPixyNetLoaderPocoDownSLIMAGENTSTEELHOOKSedrecoSeduploaderSpyPressUnidentified 078 (Zebrocy Nim Loader?)Unidentified 114 (APT28 InfoStealer)Unidentified JS 007 (Zimbra Stealer)X-AgentX-Tunnel (.NET)XP PrivEsc (CVE-2014-4076)XTunnelZebrocyZebrocy (AutoIT)
CVEs seen in reporting
ATT&CK techniques in reports
- T1566.001 Spearphishing Attachment29
- T1071.001 Web Protocols25
- T1546.015 Component Object Model Hijacking21
- T1204.001 Malicious Link18
- T1204.002 Malicious File17
- T1082 System Information Discovery16
- T1203 Exploitation for Client Execution16
- T1027 Obfuscated Files or Information15
- T1140 Deobfuscate/Decode Files or Information15
- T1583.001 Domains15
- T1102 Web Service14
- T1105 Ingress Tool Transfer14
- T1113 Screen Capture14
- T1114.002 Remote Email Collection14
- T1005 Data from Local System13
- T1583.003 Virtual Private Server13
- T1059.001 PowerShell13
- T1041 Exfiltration Over C2 Channel12
- T1053.005 Scheduled Task12
- T1070.004 File Deletion12
Also known as
SNAKEMACKEREL, GruesomeLarch, BlueDelta, Forest Blizzard, FANCY BEAR, Group 74, Fighting Ursa, ITG05, Blue Athena, Grizzly Steppe, G0007, Sednit, APT-C-20, Pawn Storm, STRONTIUM, IRON TWILIGHT, T-APT-12, UAC-0028, Sofacy, SIG40, TA422, Fancy Bear, TG-4127, Swallowtail, Tsar Team, FROZENLAKE, UAC-0001, LAKE RELIC, ATK5