Also known as: Sofacy Group
First known appearance: 2007
Threat Actors: Russian government
Targets: The Caucasus, particularly Georgia, eastern European countries and militaries, North Atlantic Treaty Organization (NATO) and other European security organizations and defense firms
Objective: To gain insider information related to governments, militaries and security organizations.
Overview: APT28 is a skilled team of developers and operators collecting intelligence on defense and geopolitical issues—intelligence that would be useful only to a government. This APT group compiles malware samples with Russian language settings during working hours (8 a.m. to 6 p.m.), consistent with the time zone of Russia’s major cities, including Moscow and St. Petersburg. This suggests that APT28 receives direct ongoing financial and other resources from a well-established organization, most likely the Russian government.
Associated malware: Chopstick, Sourface
Typical attack vectors: Tools commonly used by APT28 include the Sourface downloader, its second-stage backdoor Eviltoss and a modular family of implants dubbed Chopstick. APT28 has employed RSA encryption to protect files and stolen information moved from the victim’s network to the controller. It has also made incremental and systematic changes to the Sourface downloader and its surrounding ecosystem since 2007, indicating a long-standing and dedicated development effort.