APT28
threat actorRUalso known as
Other names and identifiers for this entity.
ATT&CK
APT28 · FROZENLAKE · Fancy Bear · Forest Blizzard · Group 74 · GruesomeLarch · IRON TWILIGHT · Pawn Storm · SNAKEMACKEREL · STRONTIUM · Sednit · Sofacy · Swallowtail · TG-4127 · Threat Group-4127 · Tsar Team
MISP
APT-C-20 · APT28 · ATK5 · Blue Athena · BlueDelta · FANCY BEAR · FROZENLAKE · Fighting Ursa · Forest Blizzard · Grizzly Steppe · Group 74 · GruesomeLarch · IRON TWILIGHT · ITG05 · LAKE RELIC · Pawn Storm · SIG40 · SNAKEMACKEREL · STRONTIUM · Sednit · Sofacy · Swallowtail · T-APT-12 · TA422 · TG-4127 · Tsar Team · UAC-0001 · UAC-0028
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.
resolved ATT&CK groups
Threat groups associated with this.
techniques used (93)
ATT&CK techniques this enables or maps to.
campaigns (1)
Campaigns that use this.
software used (30)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://attack.mitre.org/groups/G0007/
- https://en.wikipedia.org/wiki/Fancy_Bear
- https://en.wikipedia.org/wiki/Sofacy_Group
- https://www.bbc.com/news/technology-37590375
- https://www.bbc.co.uk/news/technology-45257081
- https://www.cfr.org/interactive/cyber-operations/apt-28
- https://www.apnews.com/4d174e45ef5843a0ba82e804f080988f
- https://www.voanews.com/a/iaaf-hack-fancy-bears/3793874.html