AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT28
Aliases: APT28, FROZENLAKE, Fancy Bear, Forest Blizzard, Group 74, GruesomeLarch, IRON TWILIGHT, Pawn Storm, SNAKEMACKEREL, STRONTIUM, Sednit, Sofacy, Swallowtail, TG-4127, Threat Group-4127, Tsar Team
[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034).
Open interactive actor investigation
ATT&CK techniques
T1001.001T1003T1003.001T1003.003T1005T1014T1021.002T1025T1027.013T1030T1036T1036.005T1037.001T1039T1040T1048.002T1056.001T1057T1059.001T1059.003T1068T1070.004T1070.006T1071.001T1071.003T1074.001T1074.002T1078T1078.004T1083T1090.002T1090.003T1091T1092T1098.002T1102.002T1105T1110T1110.001T1110.003T1113T1114.002T1119T1120T1133T1134.001T1137.002T1140T1189T1190T1199T1203T1204.001T1204.002T1210T1211T1213T1213.002T1218.011T1221T1498T1505.003T1528T1542.003T1546.015T1547.001T1550.001T1550.002T1557.004T1559.002T1560T1560.001T1564.001T1564.003T1566.001T1567T1573.001T1583.001T1583.003T1583.006T1584.008T1586.002T1588.002T1588.007T1589.001T1591T1595.002T1596T1598T1598.003T1669T1684.001T1685.005
Correlated CTI and IR reports
AI in Offensive Operations: How Threat Actors Use Artificial Intelligence
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Kill Chain An Analyst Guide With Real World Evidence
1200km Medium · authored report mentionCTI Research Sandworm APT44
1200km Medium · authored report mentionComprehensive Guide to DoS and DDoS Attacks with MITRE ATT CK
1200km Medium · authored report mention
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Kill Chain An Analyst Guide With Real World Evidence
1200km Medium · authored report mentionCTI Research Sandworm APT44
1200km Medium · authored report mentionComprehensive Guide to DoS and DDoS Attacks with MITRE ATT CK
1200km Medium · authored report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- certutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Responder tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Winexe tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Forfiles tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Koadic tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Wevtutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- cipher.exe tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1001.001 Junk Data simulation — Exact active technique ID
- T1001.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003 OS Credential Dumping simulation — Exact active technique ID
- T1003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1014 Rootkit simulation — Exact active technique ID
- T1014 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1025 Data from Removable Media simulation — Exact active technique ID
- T1025 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1030 Data Transfer Size Limits simulation — Exact active technique ID
- T1030 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036 Masquerading simulation — Exact active technique ID
- T1036 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037.001 Logon Script (Windows) simulation — Exact active technique ID
- T1037.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1039 Data from Network Shared Drive simulation — Exact active technique ID
- T1039 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1040 Network Sniffing simulation — Exact active technique ID
- T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol simulation — Exact active technique ID
- T1048.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.003 Mail Protocols simulation — Exact active technique ID
- T1071.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.002 Remote Data Staging simulation — Exact active technique ID
- T1074.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.003 Multi-hop Proxy simulation — Exact active technique ID
- T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1091 Replication Through Removable Media simulation — Exact active technique ID
- T1091 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1092 Communication Through Removable Media simulation — Exact active technique ID
- T1092 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.002 Additional Email Delegate Permissions simulation — Exact active technique ID
- T1098.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.002 Bidirectional Communication simulation — Exact active technique ID
- T1102.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.001 Password Guessing simulation — Exact active technique ID
- T1110.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.003 Password Spraying simulation — Exact active technique ID
- T1110.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1113 Screen Capture simulation — Exact active technique ID
- T1113 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.002 Remote Email Collection simulation — Exact active technique ID
- T1114.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1120 Peripheral Device Discovery simulation — Exact active technique ID
- T1120 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1134.001 Token Impersonation/Theft simulation — Exact active technique ID
- T1134.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1137.002 Office Test simulation — Exact active technique ID
- T1137.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1210 Exploitation of Remote Services simulation — Exact active technique ID
- T1210 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1211 Exploitation for Stealth simulation — Exact active technique ID
- T1211 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213 Data from Information Repositories simulation — Exact active technique ID
- T1213 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.002 Sharepoint simulation — Exact active technique ID
- T1213.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1221 Template Injection simulation — Exact active technique ID
- T1221 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1498 Network Denial of Service simulation — Exact active technique ID
- T1498 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1528 Steal Application Access Token simulation — Exact active technique ID
- T1528 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1542.003 Bootkit simulation — Exact active technique ID
- T1542.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.015 Component Object Model Hijacking simulation — Exact active technique ID
- T1546.015 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1550.001 Application Access Token simulation — Exact active technique ID
- T1550.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1550.002 Pass the Hash simulation — Exact active technique ID
- T1550.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1557.004 Evil Twin simulation — Exact active technique ID
- T1557.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1559.002 Dynamic Data Exchange simulation — Exact active technique ID
- T1559.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.001 Hidden Files and Directories simulation — Exact active technique ID
- T1564.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.003 Hidden Window simulation — Exact active technique ID
- T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567 Exfiltration Over Web Service simulation — Exact active technique ID
- T1567 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.008 Network Devices simulation — Exact active technique ID
- T1584.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.002 Email Accounts simulation — Exact active technique ID
- T1586.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.007 Artificial Intelligence simulation — Exact active technique ID
- T1588.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.001 Credentials simulation — Exact active technique ID
- T1589.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591 Gather Victim Org Information simulation — Exact active technique ID
- T1591 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1596 Search Open Technical Databases simulation — Exact active technique ID
- T1596 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598 Phishing for Information simulation — Exact active technique ID
- T1598 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.003 Spearphishing Link simulation — Exact active technique ID
- T1598.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1669 Wi-Fi Networks simulation — Exact active technique ID
- T1669 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
- T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Microsoft's STRONTIUM vaccine-targeting assessment; targeting is not confirmed theft. Evidence cutoff: 2026-09-25.