Security Resilience

Campaign · all campaigns

Operation GhostC0023 state

🇷🇺 RU · SVR

aka Operation Ghost

Run by APT29

Last updated: 2026-10-16

1attributed CVEs
16ATT&CK techniques
3.2IDF score (tooling uniqueness)
0exclusive CVEs
2026years active

About this actor

[Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During [Operation Ghost](https://attack.mitre.org/campaigns/C0023), [APT29](https://attack.mitre.org/groups/G0016) used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

Source: MITRE ATT&CK

How we know this

Data origin
MITRE ATT&CK campaign Imported from the MITRE ATT&CK STIX bundle as a campaign object.
Techniques
MITRE ATT&CK STIX mappings — 16 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2026: 1 CVE published2026: 1 KEV added22026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2025-66376 KEV8.07.20.28822026-01-05see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
CM-69 / 1656%
SI-48 / 1650%
CM-27 / 1644%
CA-76 / 1638%
SI-36 / 1638%
AC-35 / 1631%
SC-75 / 1631%
AC-24 / 1625%
AC-44 / 1625%
AC-64 / 1625%
CM-74 / 1625%
AC-53 / 1619%
CM-53 / 1619%
IA-23 / 1619%
IA-122 / 1612%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category