APT28G0007 state

About this actor

[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034).

Source: MITRE ATT&CK

Activity timeline

• 2026 — 1 CVE published
• 2025 — 1 KEV added
• 2024 — 1 CVE published, 1 KEV added
• 2023 — 3 CVE published, 7 KEV added
• 2022 — 1 CVE published, 7 KEV added
• 2021 — 5 CVE published, 14 KEV added
• 2020 — 8 CVE published
• 2019 — 8 CVE published
• 2017 — 3 CVE published
• 2015 — 1 CVE published

Find actors who…

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• APT29 20 shared CVEs
• Sandworm Team 18 shared CVEs
• Dragonfly 17 shared CVEs
• menuPass 11 shared CVEs
• APT41 11 shared CVEs
• Equation 10 shared CVEs
• NOTROBIN 10 shared CVEs
• Clop 7 shared CVEs
• HAFNIUM 7 shared CVEs
• Leviathan 7 shared CVEs

Similar actors