APT28 (Fancy Bear) Threat Actor Profile and Defences

APT28 is a Russian military intelligence unit that steals credentials at scale, then uses legitimate accounts, mailboxes and network devices to collect intelligence for years without deploying much custom malware. Governments in the US, UK and across Europe attribute it to the GRU 85th Main Special Service Centre, military unit 26165. This profile covers who the group is, what it targets, the ATT&CK techniques that matter most to defenders, how it abuses identities, and the incidents that shaped current guidance. It is written for security operations, identity and infrastructure teams who need to decide which controls and detections to prioritise. For the wider landscape of state and criminal groups, see the Threat Actor Groups Guide.

Key takeaways

Credentials are the main entry point. Password spraying, brute force over Tor and commercial VPNs, credential phishing pages and NTLM hash theft appear in almost every recent government advisory on the group.
Edge and small office devices are infrastructure. Compromised Ubiquiti EdgeRouters, IP cameras and other internet-facing devices were used to harvest credentials, relay NTLM and observe targets.
Mailbox persistence outlives password resets. Changed folder permissions and added delegates (T1098.002) keep email flowing to the actor after the account itself is cleaned up.
Any network that accepts only a password is a gap. The Nearest Neighbor intrusion reached a target over its enterprise Wi-Fi, which did not require MFA, from a compromised organisation in a nearby building.
NTLM and phishable MFA are the controls to retire first. Every advisory since 2023 recommends phishing-resistant MFA, blocking outbound SMB and NTLM, and a plan to disable NTLM.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as G0007 APT28. Microsoft has described the group, which it calls Forest Blizzard, as focused mainly on intelligence collection in support of Russian foreign policy since at least 2010. The joint advisory AA25-141A (May 2025), co-sealed by 22 agencies from 10 countries including NSA, FBI, CISA, NCSC-UK, BSI and ANSSI, names it as GRU unit 26165. In July 2025 the UK government attributed the AUTHENTIC ANTICS malware to the same unit and announced sanctions on GRU units 26165, 29155 and 74455 and 18 named officers.

Name	Who uses it	Notes
APT28	MITRE ATT&CK, most vendors and governments	Most widely used name
Fancy Bear	CrowdStrike, press	Common in media coverage
Forest Blizzard (formerly STRONTIUM)	Microsoft	Used in Microsoft detections and blog posts
Sofacy, Sednit, Pawn Storm	Older vendor reporting	Often names malware families or campaigns
BlueDelta	Listed in AA25-141A	Used for webmail exploitation reporting
GruesomeLarch	Volexity	Used in the Nearest Neighbor report
IRON TWILIGHT, Threat Group-4127, Group 74, Tsar Team, SNAKEMACKEREL, Swallowtail, FROZENLAKE	Other vendors listed by ATT&CK	Overlapping clusters
UAC-0001	CERT-UA	Ukrainian tracking ID

Do not confuse APT28 with Sandworm (GRU unit 74455), which carries out disruptive and destructive operations, or with APT29, which belongs to the SVR foreign intelligence service. Vendor names do not always map one to one, so check the alias mapping before merging intelligence from different reports.

Targeting and motivation

The motive is espionage for Russian military and foreign policy aims, with occasional hack-and-leak operations. The US Department of Justice indicted GRU officers in 2018 over the 2016 intrusions into US Democratic Party organisations, the best-known example of stolen data being published for influence.

Government, military and defence: ministries, armed forces and defence suppliers in Ukraine, NATO members and the Middle East.
Logistics and technology supporting Ukraine: AA25-141A describes targeting of ports, airports, rail, maritime, air traffic management and IT service providers in at least 12 European countries and the US, plus pivots to their business partners (T1199 Trusted Relationship).
Energy, transport, NGOs, media and education: named by Microsoft as recurring targets.
Individuals with Ukraine expertise: the Nearest Neighbor victim was chosen for staff working on Ukraine-related projects.
Physical surveillance support: from March 2022 the group sought access to more than 10,000 internet-connected IP cameras, 81% of them in Ukraine, near border crossings, military sites and rail stations, according to AA25-141A.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 maps more than 90 techniques to G0007. The table below shows the ones that recur in government advisories since 2023 and that defenders can act on.

Tactic	Technique	How it shows up	Primary control
Resource development	T1584.008 Network Devices	Compromised EdgeRouters and other SOHO devices host phishing pages and relay traffic	Block known-bad infrastructure, reputation filtering
Initial access	T1110.003 Password Spraying, T1110.001 Password Guessing	Low-and-slow attempts over Tor, VPNs and rotating IPs	Phishing-resistant MFA, smart lockout
Initial access	T1190 Exploit Public-Facing Application	Roundcube webmail flaws (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026)	Patch webmail, WAF
Initial access, reconnaissance	T1566.001 Spearphishing Attachment, T1598.003 Spearphishing Link	Lures in the victim's language, credential pages, WinRAR CVE-2023-38831 archives, Office CVE-2026-21509 documents	Mail filtering, attachment sandboxing, patching
Credential access	T1187 Forced Authentication (via CVE-2023-23397)	Outlook reminders leak Net-NTLMv2 hashes over SMB	Patch Outlook, block outbound TCP 445
Credential access	T1003.003 NTDS, T1003.001 LSASS Memory	ntdsutil and volume shadow copies to take ntds.dit	Tiered admin, LSASS protection, DC monitoring
Privilege escalation	T1068 Exploitation for Privilege Escalation	GooseEgg tool exploiting Print Spooler CVE-2022-38028	Patch, disable Print Spooler on DCs
Persistence	T1098.002 Additional Email Delegate Permissions	Folder permissions changed so any authenticated user, or the actor, can read mail	Audit mailbox permission changes
Lateral movement	T1550.002 Pass the Hash, T1021.002 SMB/Windows Admin Shares	Impacket, PsExec and RDP with stolen credentials	Restrict admin shares, LAPS, segmentation
Initial access	T1669 Wi-Fi Networks	Joined enterprise Wi-Fi with sprayed credentials from a neighbouring building	Certificate-based Wi-Fi authentication
Collection	T1114.002 Remote Email Collection	Email pulled over EWS and IMAP	Disable legacy protocols, monitor EWS
Defense impairment	T1685.005 Clear Windows Event Logs	wevtutil used to clear logs	Forward logs centrally, alert on clearing

How they abuse identities and credentials

APT28 rarely needs a sophisticated exploit once it holds a working credential. The identity pattern across advisories is consistent.

Harvesting at scale: password spraying from anonymising infrastructure, browser-in-the-browser and cross-site scripting webmail phishing, and Python scripts on compromised routers that validated stolen webmail credentials, according to the February 2024 FBI-led EdgeRouter advisory.
NTLM abuse: CVE-2023-23397 caused Outlook on Windows to send the user's Net-NTLMv2 hash to an attacker-controlled server without user interaction. The hashes can be relayed or cracked offline. Microsoft reported that after relaying hashes to Exchange the actor used EWS to change folder permissions, a change that survives a password reset.
Directory theft: taking ntds.dit and SYSTEM hives gives every domain account hash, including service accounts. Recovering from that means resetting the krbtgt account twice and rotating service account passwords, not just user passwords. See the Service Account Security Guide.
Stored secrets: AA25-141A reports retrieval of Group Policy Preferences passwords and LDAP password spraying inside the domain.
Account persistence: the actor enrolled compromised accounts in MFA and changed mailbox folder permissions, so the account looked properly secured while remaining under its control.
Cloud token theft: the UK NCSC analysis of AUTHENTIC ANTICS, as reported in July 2025, describes malware that steals credentials and tokens for Microsoft cloud services and sends mail from the victim's account to actor-controlled inboxes.
Password-only networks: the Nearest Neighbor victim protected internet-facing services with MFA, but its Wi-Fi accepted a domain username and password. See the Password Spraying and Credential Stuffing Defence Guide.

Notable incidents

Date	Event	Source	Lesson for defenders
2016	Intrusions into US Democratic Party organisations, later the subject of a 2018 US indictment of GRU officers	US Department of Justice	Stolen email can be used for influence, not just intelligence
Feb 2022	Nearest Neighbor intrusion via a neighbouring building's Wi-Fi, reported by Volexity in November 2024	Volexity	Wi-Fi is remote access and needs the same authentication as VPN
2022 to 2023	Exploitation of Outlook CVE-2023-23397 against European government, transport and energy organisations	Microsoft	Block outbound SMB and protect high-value users from NTLM
Feb 2024	FBI, NSA and partners describe compromised Ubiquiti EdgeRouters used for credential harvesting and NTLM relay	FBI joint advisory	Consumer-grade edge devices with default credentials become attacker infrastructure
Apr 2024	Microsoft details GooseEgg, a credential theft tool exploiting Print Spooler CVE-2022-38028, in use since at least June 2020	Microsoft Threat Intelligence	Domain controllers do not need Print Spooler
May 2025	AA25-141A on targeting of logistics and technology firms aiding Ukraine, plus IP camera access	CISA, NSA, FBI, NCSC-UK and partners	Suppliers and partners are in scope; cameras need authenticated RTSP
Jul 2025	UK attributes AUTHENTIC ANTICS malware to unit 26165 and sanctions GRU units	UK government via NCSC	Cloud tokens stolen from endpoints bypass password resets
Jan to Feb 2026	Exploitation of Microsoft Office CVE-2026-21509 within days of disclosure against Ukrainian and European government and transport targets	CERT-UA, Zscaler and Trellix as reported by The Hacker News	Patch windows for Office are now measured in days

Detection and defence

Priority controls

Close password-only paths: inventory every service that accepts a password alone, including Wi-Fi (802.1X with PEAP-MSCHAPv2), VPN, webmail, legacy mail protocols (IMAP, POP, EWS basic auth) and device management interfaces. Move Wi-Fi to EAP-TLS certificates and require phishing-resistant MFA elsewhere. See the Phishing-Resistant MFA Guide and the Wi-Fi Security Guide.
Contain NTLM: block outbound TCP 445 at the perimeter, host firewall and VPN split tunnels; add privileged and high-value users to the Protected Users group; enable SMB signing and Extended Protection for Authentication; then audit and disable NTLM in stages.
Patch the exploited set quickly: Outlook CVE-2023-23397, Print Spooler CVE-2022-38028, WinRAR CVE-2023-38831, Roundcube flaws and Office CVE-2026-21509. Disable Print Spooler on domain controllers.
Harden edge devices: factory reset suspected routers (a reboot does not remove the malware), update firmware, remove default credentials, and block WAN-side management. Replace unsupported IP cameras, require authenticated RTSP and disable UPnP. See the Edge Device Security Guide.
Protect the directory: deploy EDR on domain controllers and mail servers first, as AA25-141A advises, remove GPP passwords and rotate any exposed credentials, and separate privileged accounts by role. See the Active Directory and Entra ID Hardening Guide.

What to monitor

Signal	Log source	Why it matters
Many failed sign-ins across accounts from Tor, VPN or residential IPs	IdP sign-in logs, Windows event 4625, 4771	Password spraying and guessing
Outbound SMB or WebDAV to internet addresses	Firewall, proxy, SMBClient events 30800, 30803, 30804, 30806, 31001	NTLM hash leakage (CVE-2023-23397 pattern)
Mailbox folder permission or delegate changes	Exchange audit log (Set-MailboxFolderPermission, Add-MailboxPermission, EWS UpdateFolder)	T1098.002 persistence
New MFA method registered shortly after a risky sign-in	IdP audit log	Actor securing a stolen account
ntdsutil, vssadmin, reg save of SYSTEM or SAM, wevtutil cl	EDR, Sysmon, event 4688, event 1102 and 104	Credential dumping and log clearing
Wi-Fi or VPN sessions for users who are physically elsewhere	RADIUS/NPS logs, badge data	Nearest Neighbor style access
Large EWS or IMAP downloads	Exchange and mail audit logs	T1114.002 collection

Metrics that show progress

Password-only access paths: number of services, SSIDs and protocols still accepting a password without a second factor, trending to zero.
NTLM share: percentage of authentications using NTLM, from domain controller NTLM auditing.
Patch latency: days from release to deployment for actively exploited Office, Outlook and Windows flaws.
Edge device hygiene: percentage of routers and cameras on supported firmware with no default credentials.
Mailbox permission review: percentage of mailboxes with non-default folder permissions reviewed in the last quarter.

Common failure patterns

Resetting the password and stopping: folder permissions, delegates, registered MFA methods and stolen tokens survive. Revoke sessions and review mailbox and MFA changes.
MFA on the internet edge but not internally: Wi-Fi, internal webmail and legacy protocols remain password-only.
Allowing outbound SMB: one unblocked path lets any NTLM leak reach the internet.
Forgetting the directory's service accounts after an NTDS theft: rotating user passwords while service and krbtgt secrets stay the same leaves the actor with working credentials.
Treating cameras and routers as facilities equipment: unmanaged devices with default credentials become collection platforms.

Framework mapping

Defence area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	ATT&CK techniques addressed
Phishing-resistant MFA everywhere	IA-2, IA-5	PR.AA-01	T1110.003, T1078, T1669
Least privilege and admin separation	AC-6, AC-2	PR.AA-05	T1003.003, T1550.002
Boundary controls on SMB and management interfaces	SC-7, CM-7	PR.AA-05	T1187, T1584.008
Vulnerability management for exploited flaws	RA-5	ID.RA-03	T1190, T1068, T1203
Monitoring and log protection	SI-4, AU-6	DE.CM-03	T1098.002, T1114.002, T1685.005

Practitioner checklist

Map APT28 aliases (Fancy Bear, Forest Blizzard, BlueDelta, UAC-0001) in your threat intelligence platform so reports merge correctly.
List every password-only access path, including Wi-Fi and legacy mail protocols, and set a date to close each one.
Block outbound TCP 445 and WebDAV to the internet, and put high-value users in Protected Users.
Confirm Outlook CVE-2023-23397, Print Spooler CVE-2022-38028, WinRAR CVE-2023-38831 and Office CVE-2026-21509 are patched everywhere.
Disable Print Spooler on domain controllers and deploy EDR on domain controllers and mail servers first.
Alert on mailbox folder permission changes, new delegates and new MFA registrations after risky sign-ins.
Factory reset and re-image any suspect edge router; remove default credentials from cameras and routers.
Rehearse a directory compromise response that includes krbtgt, service account and mailbox permission resets.
Review partner and supplier connections if you support logistics, defence or Ukraine-related work.

APT28 (Fancy Bear) Threat Actor Profile: Credential Theft, Edge Devices and Defences