APT28
Pawn StormFANCY BEARSednitSNAKEMACKERELTsar TeamTG-4127STRONTIUMSwallowtailIRON TWILIGHTGroup 74SIG40Grizzly SteppeG0007ATK5Fighting UrsaITG05
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat. Source: MISP
Attributed country: RU according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 20 Oct 2026 · last seen on 20 Oct 2026
News
- Defense contractors in two NATO allies hacked in recent Russia-linked campaignThe Record · 20 Oct 2026
MITRE ATT&CK techniques
Reconnaissance
T1589.001CredentialsT1591Gather Victim Org Information 2 Sigma rulesT1595.002Vulnerability Scanning 1 Sigma rulesT1596Search Open Technical DatabasesT1598Phishing for InformationT1598.003Spearphishing Link
Resource Development
T1583.001DomainsT1583.003Virtual Private ServerT1583.006Web ServicesT1584.008Network DevicesT1586.002Email AccountsT1588.002Tool 7 Sigma rulesT1588.007Artificial Intelligence
Initial Access
T1078Valid Accounts 82 Sigma rulesT1078.004Cloud Accounts 35 Sigma rulesT1091Replication Through Removable MediaT1133External Remote Services 17 Sigma rulesT1189Drive-by Compromise 3 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1199Trusted Relationship 1 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1669Wi-Fi Networks
Execution
T1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1559.002Dynamic Data Exchange 1 Sigma rules
Persistence
T1037.001Logon Script (Windows) 3 Sigma rulesT1098.002Additional Email Delegate PermissionsT1137.002Office Test 2 Sigma rulesT1505.003Web Shell 33 Sigma rulesT1542.003Bootkit 1 Sigma rulesT1546.015Component Object Model Hijacking 9 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rules
Privilege Escalation
T1068Exploitation for Privilege Escalation 28 Sigma rulesT1134.001Token Impersonation/Theft 9 Sigma rules
Credential Access
T1003OS Credential Dumping 107 Sigma rulesT1003.001LSASS Memory 40 Sigma rulesT1003.003NTDS 23 Sigma rulesT1040Network Sniffing 7 Sigma rulesT1056.001Keylogging 3 Sigma rulesT1110Brute Force 21 Sigma rulesT1110.001Password Guessing 2 Sigma rulesT1110.003Password SprayingT1528Steal Application Access Token 13 Sigma rulesT1557.004Evil Twin
Discovery
T1057Process Discovery 3 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1120Peripheral Device Discovery
Lateral Movement
T1021.002SMB/Windows Admin Shares 35 Sigma rulesT1210Exploitation of Remote Services 14 Sigma rulesT1550.001Application Access Token 2 Sigma rulesT1550.002Pass the Hash 4 Sigma rules
Collection
T1005Data from Local System 12 Sigma rulesT1025Data from Removable MediaT1039Data from Network Shared Drive 2 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1074.002Remote Data StagingT1113Screen Capture 6 Sigma rulesT1114.002Remote Email CollectionT1119Automated Collection 5 Sigma rulesT1213Data from Information Repositories 11 Sigma rulesT1213.002SharepointT1560Archive Collected Data 11 Sigma rulesT1560.001Archive via Utility 10 Sigma rules
Command and Control
T1001.001Junk DataT1071.001Web Protocols 39 Sigma rulesT1071.003Mail ProtocolsT1090.002External Proxy 2 Sigma rulesT1090.003Multi-hop Proxy 3 Sigma rulesT1092Communication Through Removable MediaT1102.002Bidirectional Communication 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1573.001Symmetric Cryptography
Exfiltration
T1030Data Transfer Size LimitsT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1567Exfiltration Over Web Service 23 Sigma rules
Impact
Stealth
T1014Rootkit 1 Sigma rulesT1027.013Encrypted/Encoded FileT1036Masquerading 88 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070.004File Deletion 9 Sigma rulesT1070.006Timestomp 4 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1211Exploitation for Stealth 4 Sigma rulesT1218.011Rundll32 40 Sigma rulesT1221Template Injection 2 Sigma rulesT1564.001Hidden Files and Directories 7 Sigma rulesT1564.003Hidden Window 7 Sigma rulesT1684.001Impersonation
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗