Skip to content
Nation-state APTIdeologyStrategic sophistication · State-backed

APT28

APT28 is a Russia-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 18 sectors, including Government and Technology, in 77 countries, including the United States and the United Kingdom. It uses 228 MITRE ATT&CK techniques and exploits 48 known CVEs.

Also known as
  • Strontium
  • Group 74
  • Fancy Bear
  • Snakemackerel
  • Sig40
  • Iron Twilight
  • Sofacy
  • Sednit
  • Pawn Storm
  • Tg-4127
  • Swallowtail
  • Tsar Team
  • Threat Group-4127
  • Forest Blizzard
  • Fighting Ursa
  • TA422
  • UAC-0001
  • Operation RoundPress
  • Russian General Staff Main Intelligence Directorate
  • FROZENLAKE
  • T-APT-12
  • ATK 5
  • TAG-0700
  • UAC-0028
  • Grey-Cloud
  • GruesomeLarch
  • Blue Athena
  • TAG-110
Origin
Russia
Techniques
228
Exploited CVEs
48
Record updated

Who They Target.

Labelscredential-harvestinggrulogistics-targetingrouter-abuserussia-nexusukraine-related-targetingunit-26165

About APT28.

A Russian state-sponsored hacking group associated with Russia's GRU military intelligence agency, known for rapidly weaponizing newly disclosed Microsoft vulnerabilities.

Last updated Oct 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.