APT28 Tracker: What the Public Record Shows (2013-2026)

Russia's GRU Military Unit 26165, the 85th Main Special Service Center (GTsSS). Cyber espionage, hack-and-leak, and a public record that runs from the 2015 French broadcaster hack to the April 2026 court-authorized takedown of a hijacked-router botnet. This page collects what CISA, MITRE ATT&CK, the UK government, DOJ and on-record reporting have established.

State of Surveillance

TL;DR: APT28 is a label for a cyber unit inside Russia's GRU, formally the 85th Main Special Service Center (GTsSS), Military Unit 26165, that has been tracked as Fancy Bear, Forest Blizzard, STRONTIUM, Sofacy, Sednit, Pawn Storm, IRON TWILIGHT and others [2]. The CISA/NSA/NCSC advisory AA23-108A from April 18, 2023 calls APT28 "almost certainly" the GRU 85th GTsSS Military Intelligence Unit 26165 [1]. MITRE ATT&CK dates the group's earliest tracked activity to at least 2004 [2]. The April 7, 2026 court-authorized DOJ operation "Operation Masquerade" reset the DNS settings of compromised U.S. routers that the GRU had hijacked for espionage, with the DOJ press release identifying the actor as a unit within GRU Military Unit 26165 [4]. The on-record operational record runs from a 2015 attack on French broadcaster TV5 Monde to a 2026 router botnet takedown [3][4]. APT28 is the most publicly documented Russian GRU cyber unit through 2026.

What APT28 Actually Is

APT28 is a label for a Russian GRU cyber unit, not a single hacker. The CISA/NSA/NCSC advisory AA23-108A, released April 18, 2023 by CISA, NSA, FBI and the UK NCSC, calls APT28 "almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165" and lists the industry labels Fancy Bear, STRONTIUM, Pawn Storm, the Sednit Gang, and Sofacy [1]. MITRE ATT&CK tracks the same actor as group G0007 and lists the aliases APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE and GruesomeLarch [2]. The MITRE page dates the group's earliest tracked activity to "at least 2004" [2].

The UK government profile on GRU cyber and hybrid threat operations, updated 13 July 2026, attributes APT28 activity to GRU Unit 26165, the 85th Main Special Service Center (GTsSS), and characterizes it as a "highly sophisticated, well-established cyber actor" that conducts "advanced intelligence gathering and hack and leak operations" against Ukraine, European partners, NATO allies and the UK [3]. The same profile names three internal teams [3]:

  • Operations Team (Ops), directed by Boris Antonov, with named members Aleksey Lukashev, Ivan Yermakov and Andrey Baranov. The UK profile says the team handles spear phishing, brute force attacks, CNE/CVE exploits, social engineering, zero-day exploits and computer intrusion operations against military, political, governmental and non-governmental organisations [3].
  • Development Operations Team (DevOps), led by Sergey Morgachev, with named members Nikolai Kozachek, Artem Malyshev and Pavel Yershov. The team develops and manages the malware families X-Agent and X-Tunnel [3].
  • Operational Infrastructure Team, led by Anatoliy Istomin, with named members Igor Bochka, Aleksey Umets and Sergey Vasyuk. The team handles infrastructure procurement, testing, setup, data exfiltration, and open-source research, and is identified as the team that developed the Drovorub malware [3].

The DOJ press release for the April 7, 2026 "Operation Masquerade" takedown identifies the actor as "a unit within Russia's Main Intelligence Directorate of the General Staff (GRU) Military Unit 26165," tracked under the same alias set (APT28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, Sednit) [4]. The CyberScoop account of the same operation quotes Brett Leatherman, the FBI Cyber Division assistant director: "GRU actors compromised routers in the U.S. and around the world, hijacking them to conduct espionage" [5].

Two things distinguish APT28 from more familiar espionage crews. First, it is the most publicly attributed Russian GRU cyber unit through 2026: a 2018 U.S. indictment, two CISA joint advisories with the UK NCSC, a UK government profile with named operators and a court-authorized router-botnet takedown all carry the APT28 / GRU 26165 label [1][2][3][4]. Second, the tradecraft is unusually broad. The MITRE ATT&CK page catalogs dozens of techniques attributed to the group across enterprise IT and includes Initial Access (T1190 Exploit Public-Facing Application), Execution (T1059.001 PowerShell, T1059.003 Windows Command Shell), Credential Access (T1003 OS Credential Dumping), Lateral Movement (T1021.001 RDP, T1021.002 SMB) and Exfiltration (T1048.002 Exfiltration Over Alternative Protocol) [2]. The same page lists dozens of named software families APT28 has used, including X-Agent, X-Tunnel, ADVSTORESHELL, CHOPSTICK, CORESHELL, Drovorub, Mimikatz, Zebrocy and LoJax [2].

What is not stated in any of the five primary sources is the precise relationship between APT28 and any other GRU unit, or whether the GRU 26165 operator pool has grown or shrunk through the 2022 to 2026 war period. The UK profile distinguishes Unit 26165 (APT28) from Unit 74455 (Sandworm, "APT44") and Unit 29155 (Cadet Blizzard, the GRU's 161st Specialist Training Center) [3]. The profile describes Units 26165 and 74455 as "an advanced, comprehensive cyber capability" and covers Unit 29155 separately.

Publicly Attributed Operations

APT28's tradecraft is built to avoid detection, but the public record through October 2026 names a long list of attributed operations, mostly on the strength of indictments, government advisories, and primary-source reporting. Each entry below states who attributed it and how firmly.

TV5 Monde, France (2015)

The UK government profile lists TV5 Monde among the incidents linked to Unit 26165: "GRU Unit 26165 conducted operations to sabotage French broadcaster TV5 Monde," with France attributing the attack to the unit in 2025 [3].

German Bundestag Hack (2015)

The UK profile attributes the 2015 hack of the German Bundestag to APT28, dates the attack to April and May 2015 and says "a significant amount of data was stolen" [3]. It adds that "Email accounts of Chancellor Angela Merkel and other MPs were affected." The profile gives no email count and no exfiltration method.

D-30 Howitzer Geolocation, Donbas (2014-2016)

The UK profile documents APT28's use of X-Agent "to identify Ukrainian military hardware in Donbas between 2014 and 2016, enabling Russia to conduct artillery strikes on Ukrainian positions," under the heading "Locating D-30 Howitzers in Donbas (2014 to 2016)" [3]. The same X-Agent implant is named in the profile as the tool used in the DNC and DCCC hack.

U.S. DNC and DCCC Hack (2016)

The MITRE ATT&CK page states APT28 "reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election" [2]. The UK profile confirms the attribution and identifies X-Agent as the data-exfiltration implant used in the operation [3]. The MITRE page lists the U.S. Department of Justice 2018 indictment of five GRU Unit 26165 officers as the primary public source [2].

French Presidential Election (2017)

The UK profile documents the 2017 hack of the French presidential campaign and says the GRU "leaked over 21,000 emails 2 days before the French Presidential Election in 2017" [3]. The same source records that France attributed Unit 74455 (Sandworm), alongside Unit 26165, in a spear-phishing campaign targeting Emmanuel Macron's presidential campaign [3].

DSTL, FCDO, OPCW and Spiez Swiss Chemicals Laboratory (2018)

The UK profile documents 2018 spear-phishing attributed to APT28 against the UK's Defence Science and Technology Laboratory (DSTL), the Foreign, Commonwealth and Development Office (FCDO), the Organisation for the Prohibition of Chemical Weapons (OPCW) and the Spiez Swiss Chemicals Laboratory, and ties the operation to the investigations into the Novichok nerve agent poisoning in Salisbury [3]. The profile also records US DOJ indictments indicating Unit 74455's role alongside Unit 26165 in attempts to target the DSTL and OPCW investigations into the Novichok poisonings in Salisbury [3].

German SPD and Czech Institutions (2022)

The UK profile documents APT28 exploitation of Microsoft Outlook zero-days against the German Social Democratic Party (SPD) and Czech institutions in 2022 [3]. The profile does not name the specific Outlook zero-day.

IP Camera Mapping of Foreign Assistance to Ukraine (2022-2024)

The UK profile documents APT28 using IP camera access to map foreign assistance to Ukraine between 2022 and 2024, targeting "ports, transport hubs, technology companies, defence and government infrastructure and border crossings in Moldova, Ukraine and 11 NATO countries" [3].

Mariupol Theatre Reconnaissance (15 March 2022)

The UK profile documents APT28 "conducting online reconnaissance on civilian shelters in Mariupol and Kharkiv on 15 March 2022" [3]. The same profile records that "Russian Armed Forces conducted artillery strikes on Mariupol Theatre on 16 March 2022, killing non-combatants sheltering there, including children."

2024 Paris Olympic and Paralympic Games

The UK profile attributes APT28 activity targeting the 2024 Paris Olympic and Paralympic Games and says France attributed it to Unit 26165 in 2025 [3]. The profile gives the year of the attribution but not the statement itself.

Skripal Email Targeting (2013)

The UK profile documents a "Skripal email targeting" operation in 2013 and says the UK sanctioned Aleksey Lukashev, Ivan Yermakov and GRU Unit 26165 for "historic cross-border targeting of email accounts belonging to Yulia Skripal with X-Agent malware in 2013" [3]. The same profile places that operation alongside the GRU's wider interest in the Skripals, including the attempted murder in Salisbury in 2018.

Operation Masquerade Router Botnet (2024-2026)

The DOJ press release for the April 7, 2026 court-authorized disruption identifies the actor as GRU Military Unit 26165, "also known as APT28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit" [4]. The DOJ release describes a network of compromised small-office/home-office routers, primarily TP-Link models, that the GRU actors configured since at least 2024 to redirect DNS requests to GRU-controlled malicious DNS resolvers [4]. The DOJ release reports the affected routers were in "more than 23 U.S. states" [4]. CyberScoop reports the botnet spanned more than 18,000 routers in 120+ countries and impacted more than 200 organizations, including IT, telecom and energy sector victims, military and government personnel, and a European country's national identity platform [5]. CyberScoop reports that Microsoft insisted company-owned assets or services were not compromised as part of the campaign, and that Lumen found no evidence of any compromised U.S. government agencies [5]. CyberScoop reports the takedown team included the FBI, federal prosecutors, the National Security Division's National Security Cyber section, Lumen's Black Lotus Labs and Microsoft Threat Intelligence [5].

The Playbook: How APT28 Gets In And Stays In

The five primary sources describe a tradecraft that has shifted across operations but consistently uses spear phishing, well-maintained custom malware (X-Agent, X-Tunnel, Drovorub) and a long-running habit of exploiting internet-facing appliances. The core entry vectors and techniques:

  • Exploiting internet-facing appliances, including SOHO routers. AA23-108A documents APT28 exploiting CVE-2017-6742 (Cisco Bug ID CSCve54313), an SNMP Remote Code Execution vulnerability in Cisco IOS and IOS XE Software first announced June 29, 2017, to deploy malware on unpatched Cisco routers [1]. The advisory says APT28 "used infrastructure to masquerade Simple Network Management protocol (SNMP) access into Cisco routers worldwide" in 2021, and that this "included a small number based in Europe, US government institutions and approximately 250 Ukrainian victims" [1]. The advisory describes the group using SNMP v2, which "doesn't support encryption and so all data, including community strings, is sent unencrypted," and using weak or default SNMP community strings such as "public" to gain initial access [1]. The companion Malware Analysis Report "Jaguar Tooth" lists the IoCs but is referenced rather than contained in the advisory [1]. Separately, the April 7, 2026 Operation Masquerade takedown describes APT28 configuring compromised TP-Link SOHO routers (and, per CyberScoop, MikroTik routers) to redirect DNS requests to GRU-controlled malicious DNS resolvers [4][5]. The DOJ release says the GRU actors used the hijacked routers for "actor-in-the-Middle attacks against encrypted network traffic" and to harvest unencrypted passwords, authentication tokens, emails and other sensitive information from devices on the same network [4].
  • Microsoft Outlook and Exchange zero-days. The UK profile documents APT28 exploitation of Microsoft Outlook zero-days against the German SPD and Czech institutions in 2022 [3]. The profile does not name the specific CVE. MITRE ATT&CK documents Exploitation for Client Execution (T1203) and Exploitation of Remote Services (T1210) as part of the APT28 technique inventory [2].
  • Custom malware: X-Agent, X-Tunnel, Drovorub. MITRE ATT&CK lists dozens of software families attributed to APT28, including X-Agent for Android (S0314), XAgentOSX (S0161), XTunnel (S0117), CHOPSTICK (S0023), CORESHELL (S0137), ADVSTORESHELL (S0045), Drovorub (S0502), JHUHUGIT (S0044), Komplex (S0162), LoJax (S0397), USBStealer (S0136), Zebrocy (S0251), Mimikatz (S0002) and Koadic (S0250) [2]. The UK profile names X-Agent and X-Tunnel as DevOps Team output under Sergey Morgachev, and names Drovorub as Operational Infrastructure Team output under Anatoliy Istomin [3]. The MITRE page references the NSA/FBI August 2020 advisory "Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware" as the primary public source for the Drovorub attribution [2]. The UK profile documents X-Agent as the implant used in the Donbas howitzer geolocation operation, the DNC/DCCC hack and the Skripal email operation [3].
  • Spear phishing and brute force at scale. MITRE ATT&CK lists T1566.001 (Spearphishing Attachment), T1598 (Phishing for Information), T1598.003 (Spearphishing Link), T1110 (Brute Force), T1110.001 (Password Guessing) and T1110.003 (Password Spraying) as the credential-access and initial-access techniques attributed to APT28 [2]. The MITRE page references the NSA/CISA/FBI/NCSC July 2021 advisory "Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments" as the public source for the brute-force attribution [2]. The Operation Masquerade takedown describes the GRU using the hijacked routers to serve fraudulent DNS records mimicking legitimate services such as "Microsoft Outlook Web Access," enabling spear phishing that bypassed reputation-based filters [4].
  • Living off the land plus Mimikatz-style credential dumping. AA23-108A lists PowerShell Empire and a Python version of Empire as tools APT28 used during the Cisco router campaign, alongside custom malware that executed CLI commands and queried the ARP table for MAC addresses (T1590) [1]. MITRE ATT&CK lists the credential-access techniques T1003.001 (LSASS Memory), T1003.002 (Security Account Manager) and T1003.003 (NTDS) as the OS Credential Dumping methods attributed to APT28 [2]. The MITRE page lists Mimikatz (S0002) as associated software [2]. MITRE ATT&CK documents Pass the Hash (T1550.001) and the use of application access tokens (T1528) as alternate-authentication-material techniques [2].
  • Multi-hop proxies and infrastructure rotation. MITRE ATT&CK lists T1090.001 (Internal Proxy), T1090.002 (External Proxy) and T1090.003 (Multi-hop Proxy) as the proxy techniques attributed to APT28 [2]. The MITRE page lists T1583.001 (Domains), T1583.003 (Virtual Private Server) and T1583.006 (Web Services) as the Acquire Infrastructure techniques [2]. Operation Masquerade specifically documents hijacked SOHO routers (TP-Link and MikroTik) used as actor-in-the-middle infrastructure [4][5].
  • Wi-Fi reconnaissance and the "Nearest Neighbor" attack. MITRE ATT&CK names MITRE campaign C0051, "APT28 Nearest Neighbor Campaign," as active February 2022 through November 2024 [2]. The MITRE page references a November 22, 2024 report titled "The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access" as the primary public source [2]. The MITRE page lists T1669 (Wi-Fi Networks) as a technique attributed to APT28 [2].
  • Defense evasion, including rootkit and timestomp. MITRE ATT&CK lists T1014 (Rootkit), T1547.001 (Registry Run Keys / Startup Folder), T1070.004 (File Deletion), T1070.006 (Timestomp), T1036 (Masquerading) and T1036.005 (Match Legitimate Resource Name or Location) as the defense-evasion and persistence techniques attributed to APT28 [2]. The MITRE page lists T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) and T1140 (Deobfuscate/Decode Files or Information) as the obfuscation techniques [2].
  • Exfiltration over alternative protocols and web services. AA23-108A documents APT28 exfiltrating router data over TFTP (Trivial File Transfer Protocol) during the Cisco router campaign [1]. MITRE ATT&CK lists T1048.002 (Exfiltration Over Alternative Protocol) and T1567 (Exfiltration Over Web Service) as the exfiltration techniques attributed to APT28 [2].

The defensive lesson from the five sources is consistent. AA23-108A's mitigation steps are: patch devices as Cisco advises, avoid SNMP unless remote management is required and use allow/deny lists if it is, disallow plaintext management protocols such as SNMP v2 and Telnet, enforce strong unique per-device passwords and move toward two-factor authentication using public-private keys, replace devices that cannot support SNMP v3, and log device commands with TACACS+ and Syslog [1]. The Operation Masquerade remediation list, per the DOJ release, is: replace End-of-Life and End-of-Support routers, upgrade to the latest firmware, verify the authenticity of DNS resolvers in router settings, and review and implement firewall rules to block unwanted remote management exposure [4]. The pattern: patch, replace, verify, log.

Who Runs APT28

CISA, NSA, FBI and the UK NCSC attribute APT28 to Russia's GRU 85th Main Special Service Center (GTsSS), Military Unit 26165 [1]. The UK government profile on GRU cyber and hybrid threat operations, updated 13 July 2026, identifies the same unit and names the three internal teams (Operations, Development Operations, Operational Infrastructure) with the team leads and named members listed above [3]. The DOJ Operation Masquerade press release identifies "a unit within Russia's Main Intelligence Directorate of the General Staff (GRU) Military Unit 26165" as the actor [4]. None of the five sources records a Russian government acknowledgement of APT28 or the GRU 26165 link.

The officers and team leads the UK profile lists are Boris Antonov (Operations Team Director), Anatoliy Istomin (Operational Infrastructure Team Director) and Sergey Morgachev (Development Operations Team Director) [3]. The team members it lists are Aleksey Lukashev, Ivan Yermakov, Andrey Baranov, Nikolai Kozachek, Artem Malyshev, Pavel Yershov, Igor Bochka, Aleksey Umets and Sergey Vasyuk [3]. The MITRE ATT&CK references list includes the Mueller indictment of GRU officers (2018) and the DOJ indictment of five GRU Unit 26165 officers for operations against WADA, USADA, a U.S. nuclear facility, OPCW and Spiez Swiss Chemicals Laboratory [2]. The MITRE ATT&CK references list does not include a 2024 superseding indictment document.

What is not stated in any of the five primary sources is the precise size of the APT28 / Unit 26165 operator pool, the recruitment pipeline, the unit's annual budget, or any contracting arrangement with a private Russian firm. The UK profile characterizes Unit 29155 (Cadet Blizzard) as a "recently developed part of the GRU's cyber capability," staffed "mainly of young recruits working under seasoned handlers," and describes that unit as "ill-disciplined and haphazard" [3]. The same profile characterizes Unit 26165 (APT28) as a "highly sophisticated, well-established cyber actor" without giving the unit's internal rating or headcount.

What You Can Do If APT28 Touches Your Network

For organizations that find APT28 activity, the primary sources list specific mitigations and incident-response steps [1][2][3][4][5]:

  • Patch internet-facing appliances against CVE-2017-6742 and the equivalent SNMP weaknesses. AA23-108A documents APT28's exploitation of CVE-2017-6742 (Cisco Bug ID CSCve54313) in Cisco IOS and IOS XE Software [1]. The advisory's verification step is to verify the Cisco IOS image per Cisco guidance, revoke keys and replace ROMMON and IOS images sourced directly from Cisco [1].
  • Disable SNMP v2 and Telnet. AA23-108A says to disable SNMP if not needed, use allow/deny lists if required, and disallow unencrypted management protocols (SNMP v2, Telnet) in favor of SSH and SNMP v3 [1].
  • Replace End-of-Life and End-of-Support SOHO routers. Operation Masquerade documents APT28's reliance on compromised TP-Link and MikroTik SOHO routers, and the DOJ release tells users of those routers to replace End-of-Life and End-of-Support devices and check TP-Link's End-of-Life product lists [4][5]. The DOJ remediation list: replace, upgrade firmware, verify DNS resolver authenticity, and review firewall rules [4].
  • Enforce phishing-resistant MFA on every account that supports it. The DOJ Operation Masquerade release describes the GRU using hijacked routers to serve fraudulent DNS records mimicking Microsoft Outlook Web Access, which a phishing-resistant MFA factor blunts [4]. AA23-108A recommends enforcing strong, unique per-device passwords and moving away from legacy password authentication toward two-factor authentication using public-private keys [1].
  • Watch for the X-Agent, X-Tunnel and Drovorub implants. MITRE ATT&CK documents the APT28 software inventory, with entries for X-Agent (S0314), XAgentOSX (S0161), XTunnel (S0117), Drovorub (S0502), ADVSTORESHELL (S0045), CHOPSTICK (S0023), CORESHELL (S0137), JHUHUGIT (S0044), Komplex (S0162), LoJax (S0397) and Zebrocy (S0251) [2]. The MITRE software list names Mimikatz (S0002) and Koadic (S0250) as associated tools [2].
  • Audit router DNS settings. Operation Masquerade describes the GRU redirecting DNS requests to GRU-controlled malicious DNS resolvers via compromised TP-Link and MikroTik routers [4]. The DOJ release's remediation list includes verifying DNS resolver authenticity in router settings [4].
  • Hunt for the "Nearest Neighbor" Wi-Fi attack. MITRE ATT&CK documents APT28 campaign C0051, the Nearest Neighbor Campaign, as active February 2022 through November 2024 [2]. The MITRE page references a November 22, 2024 report on the technique as the primary public source [2]. The technique abuses nearby Wi-Fi networks for covert access; the relevant signal is a host connecting to an unexpected Wi-Fi network under the same organization.
  • Log device commands and check for default community strings. AA23-108A tells defenders to log device commands with TACACS+ and Syslog so suspicious events stand out, and points to the UK NCSC's Jaguar Tooth Malware Analysis Report for indicators of compromise [1]. The advisory also maps the group's use of weak SNMP community strings, including the default "public," to the Valid Accounts technique [1].
  • Report to authoring agencies. AA23-108A's reporting channels: [email protected] or 1-844-Say-CISA for US organizations, and the UK NCSC for UK organizations [1]. The DOJ release separately tells users of compromised routers to contact their local FBI field office or the FBI's Internet Crime Complaint Center [4].

For IT and security leads, the single highest-impact change is replacing End-of-Life SOHO routers and verifying DNS resolver authenticity. The second highest-impact change is enforcing phishing-resistant MFA on every account that supports it, especially email, VPN and admin accounts. APT28's tradecraft leans heavily on hijacked infrastructure and stolen credentials, and both controls close those doors [1][4][5].

The Honest Takeaway

APT28 is what a state-aligned cyber unit looks like when it gets a working strategy for hijacking the infrastructure other actors depend on. The five primary sources are the public accounting: CISA AA23-108A for the 2023 Cisco router campaign and CVE-2017-6742 [1], MITRE ATT&CK G0007 for the canonical alias list, technique inventory, software inventory and the Nearest Neighbor Campaign reference [2], the UK government profile for its internal team structure, officers and documented victims from 2013 to 2024 [3], the DOJ Operation Masquerade press release for the April 7, 2026 router-botnet disruption [4], and CyberScoop for the botnet scale (18,000+ routers, 120+ countries, 200+ organizations) [5].

What does not change is the playbook. The X-Agent, X-Tunnel and Drovorub implants are still the unit's custom malware signature, as far as the public record goes. Spear phishing with hijacked-infrastructure email services is still a live initial-access vector. SOHO routers are still the infrastructure layer. The Cisco IOS and IOS XE vulnerability class is still a starting point. The defensive lesson is the same one every advisory writes: patch internet-facing appliances, replace End-of-Life SOHO routers, verify DNS resolver settings, enforce phishing-resistant MFA, and a tested incident-response procedure for local verification.

This tracker will be updated as new advisories appear and named victims are confirmed.

Sources

  1. CISA, NSA, NCSC, FBI: APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers (AA23-108A, April 18, 2023)
  2. MITRE ATT&CK, APT28 (G0007), last modified July 31, 2026
  3. UK Government, Profile: GRU cyber and hybrid threat operations (Updated 13 July 2026)
  4. DOJ, Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by Russian GRU (April 7, 2026)
  5. CyberScoop, Feds quash widespread Russia-backed espionage network spanning 18,000 devices (Matt Kapko, April 7, 2026)

Published: October 19, 2026