Security Resilience

Threat actor · all actors

APT28G0007 state

🇷🇺 RU · GRU · Unit 26165

aka APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, SIG40, Grizzly Steppe, G0007, ATK5, Fighting Ursa, ITG05, Blue Athena, TA422, T-APT-12, APT-C-20, UAC-0028, UAC-0001, BlueDelta, LAKE RELIC

Last updated: 2026-10-16

26attributed CVEs
129ATT&CK techniques
64.0IDF score (tooling uniqueness)
0exclusive CVEs
2017–2026years active

About this actor

[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034).

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0007

Microsoftweather-system names

Pawn StormForest Blizzard

CrowdStrikenation-animal names

Fancy Bear

Mandiant / genericAPT numbering

APT28

Secureworkscolour-metal names

IRON TWILIGHT

CERT-UAUAC cluster id

UAC-0028UAC-0001

ProofpointTA threat-actor id

TA422

Unclassifiedno scheme matched

SNAKEMACKERELSwallowtailGroup 74SednitSofacySTRONTIUMTsar TeamThreat Group-4127TG-4127FROZENLAKEGruesomeLarchSIG40Grizzly SteppeATK5Fighting UrsaITG05Blue AthenaT-APT-12APT-C-20BlueDeltaLAKE RELIC

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 129 ATT&CK techniques on file.
Named victims
7 extracted from reporting.

See how actor data is built for the full pipeline.

Activity timeline

2017: 1 CVE published120172019: 8 CVE published820192020: 8 CVE published820202021: 5 CVE published2021: 14 KEV added1920212022: 4 KEV added420222023: 3 CVE published2023: 7 KEV added1020232026: 1 CVE published12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2019-10149 KEV9.99.80.99962019-06-05see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-2725 KEV9.99.80.99982019-04-26see CVE
CVE-2019-9670 KEV9.99.80.99992019-05-29see CVE
CVE-2020-12641 KEV9.99.80.93272020-05-04see CVE
CVE-2020-14882 KEV9.99.81.00002020-10-21see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2021-44026 KEV9.99.80.72532021-11-19see CVE
CVE-2023-23397 KEV9.99.80.97412023-03-14see CVE
CVE-2023-42793 KEV9.99.80.99992023-09-19see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2017-6742 KEV9.28.80.21422017-07-17see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2020-4006 KEV9.09.10.55212020-11-23see CVE
CVE-2020-17144 KEV8.68.40.92732020-12-10see CVE
CVE-2019-1653 KEV8.57.50.99882019-01-24see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2023-38831 KEV8.57.80.99812023-08-23see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2020-35730 KEV7.56.10.69032020-12-28see CVE
CVE-2026-20929 6.27.50.02912026-01-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
CM-679 / 12961%
SI-476 / 12959%
CM-269 / 12953%
CA-755 / 12943%
SI-355 / 12943%
AC-353 / 12941%
AC-651 / 12940%
AC-447 / 12936%
CM-746 / 12936%
SC-746 / 12936%
AC-242 / 12933%
SI-739 / 12930%
IA-234 / 12926%
AC-532 / 12925%
CM-527 / 12921%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category