<p><strong>APT28</strong> (aka Fancy Bear, aka Pawn Storm, aka Sednit, aka Sofacy, aka Group 74, aka Sednit, aka Sofacy, aka Strontium, aka Threat Group-4127) finds its way into the news with some regularity. Most recently the group claimed to have released documents from the International Luge Federation. APT28 is probably best known for its attacks on the Democratic National Committee (DNC) and other political targets in 2016. The group has a reputation for being organized and stealthy in their campaigns. Their choice of targets often aligns with Russian geopolitical interests.</p><p>Below is an image that summarizes publicly known APT28 activity from 2014 to present:</p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/ietdH7dbRVSf05YW6MLD"/></p><p style="text-align: center;"><em>Summary of APT28 Malicious Activity</em></p><p>Activities from APT28 have been covered by a number of information security research teams since first being reported on by Trend Micro in 2014. This corpus of information on the group is spread amongst a number of sources. The Anomali Labs team has compiled a timeline of all publicly known APT28 activities and shared it in this informative <a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank">post in the </a><a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank">Anomali</a><a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank"> Forum</a>.</p>
FEATURED RESOURCES
Anomali Cyber Watch
Anomali Cyber Watch: SLEEPWALKER Passive Backdoor, GPUThor Attack Bypasses NVIDIA, Enabling Privilege Escalation and DoS; Fire Ant, TACACS Credential Harvester and more
SLEEPWALKER Passive Backdoor Uses Custom Bytecode Language and Six Covert Transports; GPUThor: Non-Uniform Rowhammer Attack Bypasses ECC on NVIDIA GPUs, Enabling Privilege Escalation and DoS; Fire Ant Pivots to Trusted Infrastructure, Deploying Router Implants and TACACS Credential Harvester; Stolen Claude Sessions Let Attackers Bypass Passwords and Two-Factor Authentication; WordlistLoader and SynkLoader Combine Social Engineering With Defense Evasion; SharePoint Authentication Bypass and RCE Flaws Chained for Unauthenticated Code Execution
Cyber Threat Intelligence
Operationalized Threat Intelligence
Chinese-Made Components in Military Drones: What the MoD Data Breach Near-Miss Reveals About Hardware Supply Chain Risk
Royal Navy K3 Scout cameras signaled a Chinese IP despite passing NDAA checks. Why hardware supply chain risk hides below tier-1 compliance.
Anomali Cyber Watch
Sapphire Sleet Linked to Supply Chain Compromise of Rust arrayref Crate, New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign, MacSync Stealer: Tracking Rotating macOS Infrastructure Through Behavioral Patterns, and more
Sapphire Sleet Linked to Supply Chain Compromise of Rust arrayref Crate, New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign, MacSync Stealer: Tracking Rotating macOS Infrastructure Through Behavioral Patterns, Suspected Ransomware Affiliate Behind Fake "Rescue" Offer to Victims, Manic: New Android Malware Blending Banking Fraud, Spyware, and Peer-to-Peer Data Relay