APT28

    RussiaState-sponsoredUnknown

    Observation period

    93

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government
    • Military

    Target countries according to source Georgia, France, Jordan, United States, Hungary, World Anti-Doping Agency, Armenia, Tajikistan, Japan, NATO, Ukraine, Belgium, Pakistan, Asia Pacific Economic Cooperation, International Association of Athletics Federations, Turkey, Mongolia, OSCE, United Kingdom, Germany, Poland, European Commission, Afghanistan, Kazakhstan, China

    Aliases

    • Pawn Storm
    • FANCY BEAR
    • Sednit
    • SNAKEMACKEREL
    • Tsar Team
    • TG-4127
    • STRONTIUM
    • Swallowtail
    • IRON TWILIGHT
    • Group 74
    • SIG40
    • Grizzly Steppe
    • ATK5
    • Fighting Ursa
    • ITG05
    • Blue Athena
    • TA422
    • T-APT-12
    • APT-C-20
    • UAC-0028
    • UAC-0001
    • FROZENLAKE
    • Sofacy
    • Forest Blizzard
    • BlueDelta
    • GruesomeLarch
    • LAKE RELIC

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    ATT&CK campaigns

    Linked ATT&CK campaign profiles in which this group is named as an actor.

    External references

    Back to group overview