Procedure examples

Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.

APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.

APT28 has used CVE-2015-4902 to bypass security features.

APT28 has collected files from various information repositories.

APT28 has collected information from Microsoft SharePoint services within target networks.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.

In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".

APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.

APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.

APT28 has deployed malware that has copied itself to the startup directory for persistence.

APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.

APT28 has used pass the hash for lateral movement.

APT28 has used a Wi-Fi Pineapple to set up Evil Twin Wi-Fi Poisoning for the purposes of capturing victim credentials or planting espionage-oriented malware.

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.

APT28 has saved files with hidden file attributes.

APT28 has used the WindowStyle parameter to conceal PowerShell windows.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

APT28 can exfiltrate data over Google Drive.

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.

APT28 hosted phishing domains on free services for brief periods of time during campaigns.

APT28 has used newly-created Blogspot pages for credential harvesting operations.

APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.

APT28 has used compromised email accounts to send credential phishing emails.

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

APT28 has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.

APT28 has harvested user's login credentials.

APT28 has used large language models (LLMs) to gather information about satellite capabilities.

APT28 has performed large-scale scans in an attempt to find vulnerable servers.

APT28 has used large language models (LLMs) to assist in script development and deployment.

APT28 has used spearphishing to compromise credentials.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.

APT28 has exploited open Wi-Fi access points for initial access to target devices using the network.

LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials.

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.