APT28
MISPNation-state
RU
Unknown
[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)
[APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034).
Tecniche Utilizzate (91)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1001.001 | Junk Data | - |
| T1003 | OS Credential Dumping | - |
| T1003.001 | LSASS Memory | - |
| T1003.003 | NTDS | - |
| T1005 | Data from Local System | - |
| T1014 | Rootkit | - |
| T1021.002 | SMB/Windows Admin Shares | - |
| T1025 | Data from Removable Media | - |
| T1027.013 | Encrypted/Encoded File | - |
| T1030 | Data Transfer Size Limits | - |
| T1036 | Masquerading | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1037.001 | Logon Script (Windows) | - |
| T1039 | Data from Network Shared Drive | - |
| T1040 | Network Sniffing | - |
Alias (8288)
Malware Utilizzato (28)
Metadata
| ID: | 54 |
| Created: | 13/01/2026 17:48 |
| Updated: | 20/04/2026 16:00 |