APT28
Threat actorAttributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT28Our name
- SNAKEMACKERELAccenture
- Group 74Cisco Talos
- Fancy BearCrowdStrike
- Tsar TeamESET
- STRONTIUMKaspersky
- SednitMandiant
- SofacyMandiant
- Forest BlizzardMicrosoft
- FROZENLAKEMITRE ATT&CK
- GruesomeLarchMITRE ATT&CK
- IRON TWILIGHTSecureworks
- Pawn StormSecureworks
- TG-4127Secureworks
- Threat Group-4127Secureworks
- SwallowtailSymantec
Known techniques
- T1001.001Junk Data
- T1003OS Credential Dumping
- T1003.001LSASS Memory
- T1003.003NTDS
- T1005Data from Local System
- T1014Rootkit
- T1021.002SMB/Windows Admin Shares
- T1025Data from Removable Media
- T1027.013Encrypted/Encoded File
- T1030Data Transfer Size Limits
- T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1037.001Logon Script (Windows)
- T1039Data from Network Shared Drive
- T1040Network Sniffing
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1056.001Keylogging
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1068Exploitation for Privilege Escalation
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1071.003Mail Protocols
- T1074.001Local Data Staging
- T1074.002Remote Data Staging
- T1078Valid Accounts
- T1078.004Cloud Accounts
- T1083File and Directory Discovery
- T1090.002External Proxy
- T1090.003Multi-hop Proxy
- T1091Replication Through Removable Media
- T1092Communication Through Removable Media
- T1098.002Additional Email Delegate Permissions
- T1102.002Bidirectional Communication
- T1105Ingress Tool Transfer
- T1110Brute Force
- T1110.001Password Guessing
- T1110.003Password Spraying
Malware and tools used
ADVSTORESHELLCannoncertutilCHOPSTICKcipher.exeCORESHELLDealersChoiceDowndelphDrovorubForfilesFysbisHIDEDRVJHUHUGITKoadicKomplexLAMEHUGLoJaxMimikatzNetOLDBAITreGeorgResponderTorUSBStealerWevtutilWinexeXAgentOSXXTunnelZebrocy
Source: MITRE ATT&CKRecent news
No stories yet.