RURussian Federationconfidence: 50G0007
APT28APT28
Also known as: Pawn Storm · FANCY BEAR · Sednit · SNAKEMACKEREL · Tsar Team · TG-4127 · STRONTIUM · Swallowtail · IRON TWILIGHT · Group 74 · SIG40 · Grizzly Steppe · G0007 · ATK5 · Fighting Ursa · ITG05 · Blue Athena · TA422 · T-APT-12 · APT-C-20 · UAC-0028 · UAC-0001 · FROZENLAKE · Sofacy · Forest Blizzard · BlueDelta · Fancy Bear · GruesomeLarch · APT28
Origin
RU
Known aliases
29
Target sectors
2
Attribution
State-sponsored
Profile
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.
Aliases· 29
Pawn StormFANCY BEARSednitSNAKEMACKERELTsar TeamTG-4127STRONTIUMSwallowtailIRON TWILIGHTGroup 74SIG40Grizzly SteppeATK5Fighting UrsaITG05Blue AthenaTA422T-APT-12APT-C-20UAC-0028UAC-0001FROZENLAKESofacyForest BlizzardBlueDeltaFancy BearGruesomeLarchAPT28
Target sectors· 2
GovernmentMilitary
Known victims· 25
- Georgia
- France
- Jordan
- United States
- Hungary
- World Anti-Doping Agency
- Armenia
- Tajikistan
- Japan
- NATO
- Ukraine
- Belgium
MITRE ATT&CK Group crosswalk
References
- https://attack.mitre.org/groups/G0007/
- https://en.wikipedia.org/wiki/Fancy_Bear
- https://en.wikipedia.org/wiki/Sofacy_Group
- https://www.bbc.com/news/technology-37590375
- https://www.bbc.co.uk/news/technology-45257081
- https://www.cfr.org/interactive/cyber-operations/apt-28
- https://www.apnews.com/4d174e45ef5843a0ba82e804f080988f
- https://www.voanews.com/a/iaaf-hack-fancy-bears/3793874.html
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.