State-backedRussia MITRE G0007

APT28

Also known as Pawn Storm, FANCY BEAR, Sednit, SNAKEMACKEREL, Tsar Team, TG-4127, STRONTIUM, Swallowtail, IRON TWILIGHT, Group 74, SIG40, Grizzly Steppe, G0007, ATK5, Fighting Ursa, ITG05, Blue Athena, TA422, T-APT-12, APT-C-20

0mentions, 7 days

2mentions, 30 days

Oct 29, 2026last mentioned

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

Targets: Government, Military, Georgia, France, Jordan, United States, Hungary, World Anti-Doping Agency, Armenia, Tajikistan, Japan, NATO, Ukraine, Belgium, Pakistan

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1001.001 Junk Data T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1005 Data from Local System T1014 Rootkit T1021.002 SMB/Windows Admin Shares T1025 Data from Removable Media T1027.013 Encrypted/Encoded File T1030 Data Transfer Size Limits T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1037.001 Logon Script (Windows)T1039 Data from Network Shared Drive T1040 Network Sniffing T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1056.001 Keylogging T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1070.006 Timestomp T1071.001 Web Protocols T1071.003 Mail Protocols T1074.001 Local Data Staging T1074.002 Remote Data Staging T1078 Valid Accounts T1078.004 Cloud Accounts T1083 File and Directory Discovery T1090.002 External Proxy T1090.003 Multi-hop Proxy T1091 Replication Through Removable Media T1092 Communication Through Removable Media T1098.002 Additional Email Delegate Permissions T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1110 Brute Force T1110.001 Password Guessing T1110.003 Password Spraying T1113 Screen Capture T1114.002 Remote Email Collection T1119 Automated Collection T1120 Peripheral Device Discovery T1133 External Remote Services T1134.001 Token Impersonation/Theft T1137.002 Office Test T1140 Deobfuscate/Decode Files or Information T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1210 Exploitation of Remote Services T1211 Exploitation for Stealth T1213 Data from Information Repositories T1213.002 Sharepoint T1218.011 Rundll32 T1221 Template Injection T1328 Buy domain name T1346 Obtain/re-use payloads T1498 Network Denial of Service T1505.003 Web Shell T1528 Steal Application Access Token T1542.003 Bootkit T1546.015 Component Object Model Hijacking T1547.001 Registry Run Keys / Startup Folder T1550.001 Application Access Token T1550.002 Pass the Hash T1557.004 Evil Twin T1559.002 Dynamic Data Exchange T1560 Archive Collected Data T1560.001 Archive via Utility T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1566.001 Spearphishing Attachment T1567 Exfiltration Over Web Service T1573.001 Symmetric Cryptography T1583.001 Domains

Recent activity

The final speaker this evening is Feike Hacquebord, examining Russia-, China-, and DPRK-aligned APT campaigns targeting Europe in 2026, including a decade of Pa
mastodon · Oct 29, 2026
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
news · Oct 23, 2026

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.