APT28 (Fancy Bear): Operations, Malware & Attacks

APT28, better known as Fancy Bear, is one of the world's most prolific and dangerous state-sponsored hacking groups, attributed to Russia's military intelligence agency, the GRU. Active for two decades, it is the group behind the 2016 US election hack, attacks on anti-doping agencies and chemical-weapons investigators, and a relentless espionage campaign against Ukraine, NATO governments, and the defense and logistics companies supporting them. This guide explains what APT28 is, who runs it, its major operations from the DNC breach to today's router-hijacking campaigns, the malware and MITRE ATT&CK techniques it uses, and how to defend against it.

Updated: September 2026. Reflects APT28's recent webmail-exploitation (Operation RoundPress), the 2026 NCSC router and DNS-hijacking advisory, and its targeting of Ukraine-linked logistics.

The quick answer

The one line to remember: APT28 is the GRU's cyber arm, a two-decade espionage machine focused on political, military, and diplomatic intelligence for the Russian state.

What is APT28?

APT28 is an advanced persistent threat group attributed to the Russian General Staff Main Intelligence Directorate (GRU), specifically its 85th Main Special Service Center, Military Unit 26165. It has been operating since at least 2004, making it one of the longest-running state hacking groups on record, cataloged by MITRE ATT&CK as G0007.

Its motivation is purely strategic. Unlike financially-driven cybercrime crews, APT28 pursues intelligence collection, diplomatic and military espionage, and geopolitical disruption on behalf of the Russian state. It is the Russian counterpart to the Chinese state groups we profile in Volt Typhoon, Salt Typhoon, and Flax Typhoon, and it sits among the most consequential actors in our most notorious hackers roundup.

The many names of Fancy Bear

Because so many vendors have tracked APT28 over the years, it has an unusually large collection of aliases. They all refer to the same GRU unit.

If you see any of these names in a threat report, you are reading about APT28.

Major APT28 campaigns

APT28's operational history reads like a timeline of the last decade's geopolitical flashpoints.

• 2016 US election interference. APT28 breached the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and figures around the Clinton campaign, then leaked stolen material to influence the election, the operation that made "Fancy Bear" a household name.
• WADA and OPCW. It attacked the World Anti-Doping Agency (after Russian athletes were banned) and, in a 2018 close-access operation in the Netherlands, targeted the Organisation for the Prohibition of Chemical Weapons, an operation that ended with GRU officers being publicly expelled.
• European government and infrastructure attacks. Over the years it has hit the German Bundestag, France's TV5Monde, and numerous European and Ukrainian government entities.
• Ukraine-war espionage (Operation RoundPress). Since 2023, APT28 has run a webmail-exploitation campaign, documented by ESET as Operation RoundPress, using cross-site scripting flaws in Roundcube, Horde, MDaemon, and Zimbra to steal email from Ukrainian officials, defense contractors, and governments across Europe, Africa, and South America. It has weaponized webmail vulnerabilities including MDaemon's CVE-2024-11182.
• NATO logistics targeting. A 2025 joint advisory from Western agencies detailed GRU targeting of Western logistics and technology companies aiding Ukraine, including attempts to access IP cameras near borders and transit hubs to track aid shipments.
• Router and DNS hijacking. APT28 has repeatedly turned network devices into infrastructure, covered in detail below.

APT28 and router hijacking

One of APT28's signature moves is compromising network edge devices to build stealthy operational infrastructure, a pattern CISA has documented since 2023 and one that echoes the Chinese "Typhoon" groups' use of routers and IoT.

• In February 2024, the FBI and NSA disclosed (and disrupted, in "Operation Dying Ember") an APT28 campaign that repurposed a pre-existing criminal MooBot botnet running on hundreds of compromised Ubiquiti EdgeRouters, using them for credential harvesting and traffic proxying.
• The group has exploited router vulnerabilities such as CVE-2023-50224 in TP-Link devices to steal credentials worldwide.
• In an April 2026 advisory, the UK's National Cyber Security Centre detailed two new APT28 campaigns tied to virtual private servers that the group has modified since 2024 to act as malicious DNS servers, enabling DNS-hijacking operations that redirect victims and harvest credentials.

Compromised routers give APT28 disposable, hard-to-attribute infrastructure and a foothold for adversary-in-the-middle and DNS-hijacking attacks, which is why edge-device security is central to defending against it.

APT28 tactics, malware, and MITRE ATT&CK techniques

APT28 combines classic espionage tradecraft with a deep custom toolkit.

Initial access: targeted spearphishing, malicious links and attachments, and exploitation of public-facing webmail servers (Roundcube, Zimbra, MDaemon), plus credential harvesting from compromised routers.

Infrastructure and C2: APT28 abuses legitimate cloud storage services such as Koofr and Icedrive for command and control, blending its traffic into normal cloud activity.

Defense evasion: it uses DLL proxying, hides payloads with steganography inside PNG images, and runs native tools like Cipher.exe to wipe forensic evidence from disk.

Malware toolkit: over the years APT28 has deployed a large arsenal, including the X-Agent (Chopstick) backdoor, the X-Tunnel network tunneler, Zebrocy, GooseEgg (which exploited a Windows Print Spooler flaw), and lightweight loaders like HeadLace.

For the structured, technique-by-technique breakdown, the authoritative reference is the MITRE ATT&CK profile for APT28 (G0007), which maps each behavior to specific tactics and techniques for detection engineering.

An APT28 attack, step by step

A representative APT28 attack chain, drawn from its recent campaigns, looks like this:

1. Target selection. A government official, defense contractor, or logistics firm connected to a Russian strategic interest, especially the war in Ukraine.
2. Initial access. A spearphishing email or the exploitation of a webmail vulnerability, sometimes requiring only that the victim view a message ("half-click" or near-zero-click).
3. Credential and data theft. Harvesting mailbox contents, credentials, and contacts, often exfiltrated to attacker-controlled cloud storage.
4. Infrastructure abuse. Using compromised routers or VPS as proxies and malicious DNS servers to stage further operations and obscure attribution.
5. Persistence and cleanup. Maintaining quiet access while wiping logs to frustrate forensic investigation.

The through-line is patience and stealth in service of intelligence, not a quick payday.

How to defend against APT28

APT28 relies on spearphishing, webmail flaws, and edge-device compromise, so defense concentrates on those doors.

Two priorities dominate. First, harden identity and email, phishing-resistant MFA plus fast webmail patching defeats APT28's two favorite entry points, a discipline reinforced by our phishing statistics analysis. Second, secure your edge: APT28 repeatedly turns routers and VPS into weapons, so patching and monitoring network devices is not optional, which is what network penetration testing is for. A tested incident response plan then determines how fast you can contain a group that is skilled at hiding and covering its tracks.

Why this matters for security teams

APT28 is a reminder that the most dangerous adversaries are not always the flashiest. It rarely uses zero-days when a phished password or an unpatched webmail server will do, and it has sustained that approach for twenty years because it works. APT28 sits alongside the other state-sponsored APT threats that now shape enterprise risk. For any organization touching government, defense, critical infrastructure, or the Ukraine-aid supply chain, the message is that you may be a target of choice, not chance, and the defenses are unglamorous but decisive: strong authentication, disciplined patching of email and edge devices, and the monitoring to catch a patient intruder. Knowing the adversary is only useful if you test whether your defenses hold against how it actually operates.

DeepStrike's penetration testing emulates the real techniques groups like APT28 use, spearphishing, webmail and edge-device exploitation, credential theft, and lateral movement, and shows you where a nation-state actor could gain a foothold. To scope an engagement, see our penetration testing services.

FAQ

What is APT28?

APT28 is a Russian state-sponsored cyber-espionage group attributed to the GRU's Military Unit 26165 and cataloged by MITRE ATT&CK as G0007. Active since at least 2004, it conducts intelligence collection and geopolitical operations, not financially-motivated crime, and is best known by its alias "Fancy Bear."

Is APT28 the same as Fancy Bear?

Yes. APT28 and Fancy Bear are the same group, along with a long list of other vendor names including Sofacy, Sednit, STRONTIUM, Forest Blizzard (Microsoft), and Pawn Storm. They all refer to the same GRU-linked Russian threat actor; different security companies simply assigned different names.

Who is behind APT28?

APT28 is attributed to Russia's military intelligence agency, the GRU, specifically the 85th Main Special Service Center, Military Unit 26165. Western governments have publicly named and indicted GRU officers connected to its operations, including the 2016 US election interference and the 2018 OPCW attack in the Netherlands.

What are APT28's most famous attacks?

Its best-known operation is the 2016 hack of the DNC and Clinton campaign to interfere in the US election. Others include attacks on the World Anti-Doping Agency and the OPCW chemical-weapons body, the German Bundestag, France's TV5Monde, and an ongoing espionage campaign against Ukraine and its Western supporters.

What malware and techniques does APT28 use?

APT28 uses spearphishing and webmail exploits for access; abuses legitimate cloud storage (Koofr, Icedrive) for command and control; evades defenses with DLL proxying, PNG steganography, and log-wiping via Cipher.exe; and deploys malware including X-Agent, X-Tunnel, Zebrocy, GooseEgg, and HeadLace. MITRE ATT&CK G0007 maps its full technique set.

How does APT28 use routers in its attacks?

APT28 compromises network edge devices to build stealthy infrastructure. It hijacked a MooBot botnet on Ubiquiti EdgeRouters (disrupted by the FBI in 2024), exploited TP-Link router flaws like CVE-2023-50224 to steal credentials, and, per a 2026 NCSC advisory, modified virtual private servers into malicious DNS servers for DNS-hijacking operations.

How do organizations defend against APT28?

Deploy phishing-resistant MFA, patch webmail and public-facing servers quickly, secure and monitor routers and edge devices, run email security and awareness training, watch for anomalous cloud-storage C2 traffic, keep tamper-resistant logs, and hunt using MITRE ATT&CK G0007. Because APT28 favors phishing and unpatched systems over zero-days, fundamentals are what stop it.