Grupo APTMITRE G0007

APT28

También conocido como: apt-c-20, atk5, blue athena, bluedelta, fancy bear, fighting ursa, forest blizzard, frozenlake, g0007, grizzly steppe, group 74, gruesomelarch

[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US Distri

Víctimas en los últimos 90 días0

Países más afectados

Sin datos todavía.

Sectores más afectados

Sin datos todavía.

Mitigaciones prioritarias

Mitigaciones de MITRE ATT&CK que cubren más técnicas de las que usa este grupo.

Formación de usuarios (18 técnicas cubiertas)
Gestión de cuentas de usuario (13 técnicas cubiertas)
Gestión de cuentas privilegiadas (13 técnicas cubiertas)
Prevención de intrusiones en red (13 técnicas cubiertas)
Autenticación multifactor (12 técnicas cubiertas)
Políticas de contraseñas (9 técnicas cubiertas)
Cifrar la información sensible (9 técnicas cubiertas)
Desactivar o eliminar funciones o programas (9 técnicas cubiertas)

Técnicas MITRE ATT&CK

T1003.003 · NTDS T1589.001 · Credentials T1591 · Gather Victim Org Information T1564.001 · Hidden Files and Directories T1583.003 · Virtual Private Server T1596 · Search Open Technical Databases T1583.001 · Domains T1070.006 · Timestomp T1090.002 · External Proxy T1566.001 · Spearphishing Attachment T1059.001 · PowerShell T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1547.001 · Registry Run Keys / Startup Folder T1027.013 · Encrypted/Encoded File T1203 · Exploitation for Client Execution T1586.002 · Email Accounts T1114.002 · Remote Email Collection T1505.003 · Web Shell T1584.008 · Network Devices T1550.002 · Pass the Hash T1037.001 · Logon Script (Windows)T1588.002 · Tool T1564.003 · Hidden Window T1090.003 · Multi-hop Proxy T1567 · Exfiltration Over Web Service T1056.001 · Keylogging T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application T1669 · Wi-Fi Networks T1039 · Data from Network Shared Drive T1113 · Screen Capture T1110.001 · Password Guessing T1583.006 · Web Services T1057 · Process Discovery T1189 · Drive-by Compromise T1595.002 · Vulnerability Scanning T1546.015 · Component Object Model Hijacking T1199 · Trusted Relationship T1120 · Peripheral Device Discovery T1059.003 · Windows Command Shell T1557.004 · Evil Twin T1498 · Network Denial of Service T1070.004 · File Deletion T1560 · Archive Collected Data T1105 · Ingress Tool Transfer T1598 · Phishing for Information T1559.002 · Dynamic Data Exchange T1036.005 · Match Legitimate Resource Name or Location T1119 · Automated Collection T1078.004 · Cloud Accounts T1221 · Template Injection T1005 · Data from Local System T1213.002 · Sharepoint T1078 · Valid Accounts T1025 · Data from Removable Media T1071.001 · Web Protocols T1213 · Data from Information Repositories T1218.011 · Rundll32 T1560.001 · Archive via Utility T1140 · Deobfuscate/Decode Files or Information

Víctimas recientes

Sin datos todavía.

Las reivindicaciones las publican los propios grupos criminales y no están verificadas hasta que la organización o la prensa las confirman. Los nombres de personas físicas (autónomos, profesionales individuales) se anonimizan conforme al RGPD. Nunca enlazamos a sitios de filtración ni a datos robados. Para solicitar la retirada o anonimización de una entrada, contacte con el administrador del sitio.

Fuentes: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.