APT28
Pawn StormFANCY BEARSednitSNAKEMACKERELTsar TeamTG-4127STRONTIUMSwallowtailIRON TWILIGHTGroup 74SIG40Grizzly SteppeG0007ATK5Fighting UrsaITG05
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat. Fuente: MISP
País atribuido: RU según MISP
Actividad en Jábega · 12 semanas
1 noticias · vista por primera vez el 20 oct 2026 · la última, el 20 oct 2026
Noticias
- Defense contractors in two NATO allies hacked in recent Russia-linked campaignThe Record · 20 oct 2026
Técnicas MITRE ATT&CK
Reconocimiento
T1589.001CredentialsT1591Gather Victim Org Information 2 reglas SigmaT1595.002Vulnerability Scanning 1 reglas SigmaT1596Search Open Technical DatabasesT1598Phishing for InformationT1598.003Spearphishing Link
Preparación de recursos
T1583.001DomainsT1583.003Virtual Private ServerT1583.006Web ServicesT1584.008Network DevicesT1586.002Email AccountsT1588.002Tool 7 reglas SigmaT1588.007Artificial Intelligence
Acceso inicial
T1078Valid Accounts 82 reglas SigmaT1078.004Cloud Accounts 35 reglas SigmaT1091Replication Through Removable MediaT1133External Remote Services 17 reglas SigmaT1189Drive-by Compromise 3 reglas SigmaT1190Exploit Public-Facing Application 40 reglas SigmaT1199Trusted Relationship 1 reglas SigmaT1566.001Spearphishing Attachment 21 reglas SigmaT1669Wi-Fi Networks
Ejecución
T1059.001PowerShell 40 reglas SigmaT1059.003Windows Command Shell 40 reglas SigmaT1203Exploitation for Client Execution 31 reglas SigmaT1204.001Malicious Link 4 reglas SigmaT1204.002Malicious File 32 reglas SigmaT1559.002Dynamic Data Exchange 1 reglas Sigma
Persistencia
T1037.001Logon Script (Windows) 3 reglas SigmaT1098.002Additional Email Delegate PermissionsT1137.002Office Test 2 reglas SigmaT1505.003Web Shell 33 reglas SigmaT1542.003Bootkit 1 reglas SigmaT1546.015Component Object Model Hijacking 9 reglas SigmaT1547.001Registry Run Keys / Startup Folder 38 reglas Sigma
Escalada de privilegios
T1068Exploitation for Privilege Escalation 28 reglas SigmaT1134.001Token Impersonation/Theft 9 reglas Sigma
Acceso a credenciales
T1003OS Credential Dumping 107 reglas SigmaT1003.001LSASS Memory 40 reglas SigmaT1003.003NTDS 23 reglas SigmaT1040Network Sniffing 7 reglas SigmaT1056.001Keylogging 3 reglas SigmaT1110Brute Force 21 reglas SigmaT1110.001Password Guessing 2 reglas SigmaT1110.003Password SprayingT1528Steal Application Access Token 13 reglas SigmaT1557.004Evil Twin
Descubrimiento
T1057Process Discovery 3 reglas SigmaT1083File and Directory Discovery 17 reglas SigmaT1120Peripheral Device Discovery
Movimiento lateral
T1021.002SMB/Windows Admin Shares 35 reglas SigmaT1210Exploitation of Remote Services 14 reglas SigmaT1550.001Application Access Token 2 reglas SigmaT1550.002Pass the Hash 4 reglas Sigma
Recopilación
T1005Data from Local System 12 reglas SigmaT1025Data from Removable MediaT1039Data from Network Shared Drive 2 reglas SigmaT1074.001Local Data Staging 4 reglas SigmaT1074.002Remote Data StagingT1113Screen Capture 6 reglas SigmaT1114.002Remote Email CollectionT1119Automated Collection 5 reglas SigmaT1213Data from Information Repositories 11 reglas SigmaT1213.002SharepointT1560Archive Collected Data 11 reglas SigmaT1560.001Archive via Utility 10 reglas Sigma
Mando y control
T1001.001Junk DataT1071.001Web Protocols 39 reglas SigmaT1071.003Mail ProtocolsT1090.002External Proxy 2 reglas SigmaT1090.003Multi-hop Proxy 3 reglas SigmaT1092Communication Through Removable MediaT1102.002Bidirectional Communication 3 reglas SigmaT1105Ingress Tool Transfer 40 reglas SigmaT1573.001Symmetric Cryptography
Exfiltración
T1030Data Transfer Size LimitsT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1567Exfiltration Over Web Service 23 reglas Sigma
Impacto
Stealth
T1014Rootkit 1 reglas SigmaT1027.013Encrypted/Encoded FileT1036Masquerading 88 reglas SigmaT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1070.004File Deletion 9 reglas SigmaT1070.006Timestomp 4 reglas SigmaT1140Deobfuscate/Decode Files or Information 17 reglas SigmaT1211Exploitation for Stealth 4 reglas SigmaT1218.011Rundll32 40 reglas SigmaT1221Template Injection 2 reglas SigmaT1564.001Hidden Files and Directories 7 reglas SigmaT1564.003Hidden Window 7 reglas SigmaT1684.001Impersonation
Defense impairment
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗