At a glance
Facts
- Russia-linked state-sponsored threat actor
- Engaged in cyber espionage targeting NATO member states and Ukraine
APT28
Also known as IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, BlueDelta
Tracked as
G0007
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
Threat intelligence assessment
Activity timeline
Facts
- Targeted two NATO member states with attacks involving NATO naval shipbuilder, law enforcement, and military aircraft engine manufacturer
- Targeted government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026
- Repeatedly accessed compromised naval shipbuilder host over a week in hands-on-keyboard activity
- Increasingly targeting smartphones of Ukrainian military personnel and government officials since at least summer 2025
- Exploited XSS vulnerabilities in Roundcube webmail and used macro-enabled Excel documents
Attribution assessment
Facts
- HOOKEDGE shares significant code and tradecraft overlap with HEADLACE, a modular Windows implant APT28 has used since April 2023
- Symantec Threat Hunter Team tracks this activity cluster under the moniker Swallowtail
- The report notes APT28 is Russia-linked state-sponsored
- GREYVIBE is a separate threat actor attributed with persistent attacks targeting Ukraine since at least August 2025
Initial access and identity targets
Facts
- Delivered via spear-phishing lures with macro-enabled Microsoft Word documents
- Watering-hole attacks through compromised Ukrainian news outlets and government sites
- Exploited CVE-2026-21509 (Microsoft Office security feature bypass) and CVE-2026-8496 (SOGo zero-click vulnerability)
Capabilities and evasion
Facts
- Accepts attacker-issued commands and sends results back via HOOKEDGE
- Credential theft using two distinct techniques: SSH private key deployment and NTLM handshake capture
- Reflective loader designed to decrypt and run encrypted payloads in memory using runtime-supplied cryptographic keys
- Persistent SSH tunnel creation into target networks
Infrastructure patterns
Facts
- Uses webhook.site URLs for tasking and output reception in earlier variants
- Newer HOOKEDGE variants use dedicated IP address 185.82.218.119:443 for tasking and exfiltration
- Uses hidden, off-screen Microsoft Edge browser instances to fetch tasks
- Five LegionRelay C2 servers identified at: 91.149.221.118:8000, 91.149.221.123:8000, 166.88.239.54:8000, 194.87.108.12:8000, 194.87.108.217:8000
Communication and pressure channels
Facts
- HOOKEDGE communicates entirely through webhook.site URL in earlier variants
- Newer variants communicate via dedicated IP address 185.82.218.119:443
- Uses curl commands via SSH for reflective loader deployment
Observed targeting
Facts
- Targets NATO member states and Ukraine
- Focuses on entities holding information useful to foreign intelligence: naval shipbuilders, military aircraft engine manufacturers, law enforcement, diplomatic organizations, and military/government personnel smartphones
- Targeting expanded to iOS platform via DarkSword exploit kit
Named victims
Organizations
- NATO naval shipbuilder
- law enforcement agency
- manufacturer of military aircraft engines
Defender guidance
Facts
- Monitor for macro-enabled Microsoft Word and Excel documents in phishing campaigns
- Watch for SSH private key deployments and NTLM handshake capture attempts
- Monitor for persistent SSH tunnel creation patterns
- Track emerging reflective loaders and undocumented malware variants
Reported detail
Facts
- APT28 breached NATO naval shipbuilders and military contractors in NATO countries using macro-enabled spear-phishing and a previously undocumented reflective loader (ld.exe)
- The group conducted hands-on-keyboard operations, stole credentials using two independent techniques, and established persistent SSH tunnels into target networks in late July 2026
- HOOKEDGE, APT28's backdoor, evolved from using webhook.site URLs to a dedicated C2 IP address (185.82.218.119:443) for tasking and exfiltration
- APT28 has expanded targeting to Ukrainian military and government smartphones using DarkSword exploit kit since summer 2025, and exploited Microsoft Office and SOGo webmail vulnerabilities
- The group maintains established tradecraft overlap between tools (HOOKEDGE and HEADLACE) and continues testing both newer undocumented loaders and older proven delivery methods
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
Indicator12 indicators cataloged
Types: ip, tool.
First observed
CVECVE-2026-21509 linked to this actor
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
First observed
CVECVE-2026-8496 linked to this actor
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
Cataloged
IdentityAlias: Fancy Bear
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Forest Blizzard
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: BlueDelta
Reviewed identity mapping approved on this date.
Cataloged
Indicator3 indicators cataloged
Types: domain, tool.
First observed
CVECVE-2026-58231 linked to this actor
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Cataloged
IdentityAlias: IRON TWILIGHT
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: SNAKEMACKEREL
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Swallowtail
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Group 74
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Sednit
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Sofacy
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Pawn Storm
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Fancy Bear
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: STRONTIUM
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Tsar Team
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Threat Group-4127
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TG-4127
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Forest Blizzard
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: FROZENLAKE
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: GruesomeLarch
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0007
Reviewed identity mapping approved on this date.
Cataloged
CVECVE-2023-23397 linked to this actor
The interactive view includes 28 dated events with category filters and paging.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
APT28Canonical Name
FROZENLAKEAlias
Fancy BearAlias
Forest BlizzardAlias
Group 74Alias
GruesomeLarchAlias
IRON TWILIGHTAlias
Pawn StormAlias
SNAKEMACKERELAlias
STRONTIUMAlias
SednitAlias
SofacyAlias
SwallowtailAlias
TG-4127Alias
Threat Group-4127Alias
Tsar TeamAlias
BlueDeltaAlias
G0007Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...