Procedure examples

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.

APT28 has mapped network drives using Net and administrator credentials.

An APT28 backdoor may collect the entire contents of an inserted USB device.

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

APT28 has split archived exfiltration files into chunks smaller than 1MB.

APT28 has renamed the WinRAR utility to avoid detection.

APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.

An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

APT28 has collected files from network shared drives.

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.

APT28 has used tools to perform keylogging.

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.

APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

APT28 has performed timestomping on victim files.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

APT28 has stored captured credential information in a file named pi.log.

APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.

APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.

APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.

APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.

APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.

APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.

APT28 has used Google Drive for C2.

APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

APT28 can perform brute force attacks to obtain credentials.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.

APT28 has used tools to take screenshots from victims.

APT28 has collected emails from victim Microsoft Exchange servers.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.

APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.

APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.

APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.

APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.