BTCintel
nodeok
tip971,672
mempool70,446 tx
node next1.08 sat/vB
retarget40 blocks
chainmainnet

threat actor

APT28

unknownentity:threat_actor

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id
apt28
kind
threat actor
status
unknown
aliases
APT29 · APT-C-20 · ATK5 · ATK7 · Blue Athena · BlueBravo · BlueDelta · Blue Kitsune · Cloaked Ursa · COZY BEAR · DarkHalo · Fancy Bear · FANCY BEAR · Fighting Ursa · Forest Blizzard · FROZENLAKE · G0007 · G0016 · Grizzly Steppe · Group 100 · Group 74 · GruesomeLarch · ICECAP · ICE RELIC · IRON HEMLOCK · IRON TWILIGHT · ITG05 · ITG11 · LAKE RELIC · Midnight Blizzard · Minidionis · Nobelium · NOBELIUM · Pawn Storm · SeaDuke · Sednit · SIG40 · SNAKEMACKEREL · Sofacy · Solar Phoenix · StellarParticle · STRONTIUM · Swallowtail · TA421 · TA422 · T-APT-12 · TG-4127 · The Dukes · Threat Group-4127 · Tsar Team · UAC-0001 · UAC-0028 · UAC-0029 · UNC2452 · YTTRIUM
jurisdictions
—
claims naming it
0 · 0 attributions · 19 relations · 0 events

Identifiers

Relations

  • MITRE ATT&CK Enterpriserecords thatAPT28usesCHOPSTICK
    fetch —sha256 dc1639caa5501d72
    rel_492btcintel:relations:492@v1 sha256:48482d98d36e8407
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesDealersChoice
    fetch —sha256 dc1639caa5501d72
    rel_493btcintel:relations:493@v1 sha256:b51a7ea9642c257c
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesADVSTORESHELL
    fetch —sha256 dc1639caa5501d72
    rel_494btcintel:relations:494@v1 sha256:a255b089b30c56ad
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesCannon
    fetch —sha256 dc1639caa5501d72
    rel_495btcintel:relations:495@v1 sha256:fdc36696ff037ad2
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesKomplex
    fetch —sha256 dc1639caa5501d72
    rel_496btcintel:relations:496@v1 sha256:72c100d8b1afc7f1
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesHIDEDRV
    fetch —sha256 dc1639caa5501d72
    rel_497btcintel:relations:497@v1 sha256:34ed15f59271927e
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesJHUHUGIT
    fetch —sha256 dc1639caa5501d72
    rel_498btcintel:relations:498@v1 sha256:18804e5b54820a01
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesXTunnel
    fetch —sha256 dc1639caa5501d72
    rel_499btcintel:relations:499@v1 sha256:038cff255e4316ed
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesDrovorub
    fetch —sha256 dc1639caa5501d72
    rel_500btcintel:relations:500@v1 sha256:78f4494f546f6043
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesLAMEHUG
    fetch —sha256 dc1639caa5501d72
    rel_501btcintel:relations:501@v1 sha256:934798ec09a9a6eb
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesCORESHELL
    fetch —sha256 dc1639caa5501d72
    rel_502btcintel:relations:502@v1 sha256:c30da63da8fa4824
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesOLDBAIT
    fetch —sha256 dc1639caa5501d72
    rel_503btcintel:relations:503@v1 sha256:9c596f847f0876ee
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesDowndelph
    fetch —sha256 dc1639caa5501d72
    rel_504btcintel:relations:504@v1 sha256:59db1474f5f40224
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesXAgentOSX
    fetch —sha256 dc1639caa5501d72
    rel_505btcintel:relations:505@v1 sha256:c928010bd5aafb9c
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesUSBStealer
    fetch —sha256 dc1639caa5501d72
    rel_506btcintel:relations:506@v1 sha256:7217f52f87e29650
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesZebrocy
    fetch —sha256 dc1639caa5501d72
    rel_507btcintel:relations:507@v1 sha256:f0beb5e82d23e8b5
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesreGeorg
    fetch —sha256 dc1639caa5501d72
    rel_508btcintel:relations:508@v1 sha256:1809cdedc884362b
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesFysbis
    fetch —sha256 dc1639caa5501d72
    rel_509btcintel:relations:509@v1 sha256:98fcd0b87cb7b02f
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT28usesLoJax
    fetch —sha256 dc1639caa5501d72
    rel_510btcintel:relations:510@v1 sha256:cc7a5f34cb3dcc14
    confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.