Cyb3rWard0g/ATTCKGroups huggingface dataset:
APT18 can collect system information from the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT18 actors leverage legitimate credentials to log into external remote services.(Citation: RSA2017 Detect and Respond Adair)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

APT18 actors used the native

at Windows task scheduler tool to use scheduled tasks for execution on a victim network.(Citation: Dell Lateral Movement)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT18 actors leverage legitimate credentials to log into external remote services.(Citation: RSA2017 Detect and Respond Adair)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT18 actors deleted tools and batch files from victim systems.(Citation: Dell Lateral Movement)|
APT19 - G0073

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-21T20:44:02.443Z

Contributors: FS-ISAC,Darren Spruell

Aliases

APT19,Codoso,C0d0so0,Codoso Team,Sunshop Group

Description

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)

Techniques Used

APT19 used Base64 to obfuscate executed commands.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

APT19 has obtained and used publicly-available tools like

Empire.(Citation: NCSC Joint Report Public Tools)(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT19 used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT19 used PowerShell commands to execute payloads.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|
APT19 used PowerShell commands to execute payloads.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT19 used HTTP for C2 communications.

APT19 also used an HTTP malware variant to communicate over HTTP for C2.(Citation: FireEye APT19)(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|An

APT19 Port 22 malware variant registers itself as a service.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|An

APT19 HTTP malware variant establishes persistence by setting the Registry key

APT19 collected system architecture information.

APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.(Citation: FireEye APT19)(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

APT19 downloaded and launched code within a SCT file.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

APT19 used Regsvr32 to bypass application control techniques.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|An

APT19 HTTP malware variant used Base64 to encode communications to the C2 server.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT19 used Base64 to obfuscate payloads.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT19 configured its payload to inject into the rundll32.exe.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

APT19 uses a Port 22 malware variant to modify several Registry keys.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|An
APT19 HTTP malware variant decrypts strings using single-byte XOR keys.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.(Citation: FireEye APT19)|
APT28 - G0007

Created: 2017-05-31T21:31:48.664Z

Modified: 2023-03-26T17:51:20.401Z

Contributors: Sébastien Ruel, CGI,Drew Church, Splunk,Emily Ratliff, IBM,Richard Gold, Digital Shadows

Aliases

APT28,IRON TWILIGHT,SNAKEMACKEREL,Swallowtail,Group 74,Sednit,Sofacy,Pawn Storm,Fancy Bear,STRONTIUM,Tsar Team,Threat Group-4127,TG-4127

Description

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. (Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Techniques Used

APT28 has used newly-created Blogspot pages for credential harvesting operations.(Citation: Google TAG Ukraine Threat Landscape March 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1598.003|Spearphishing Link|

APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains.(Citation: Google TAG Ukraine Threat Landscape March 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1586.002|Email Accounts|

APT28 has used compromised email accounts to send credential phishing emails.(Citation: Google TAG Ukraine Threat Landscape March 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|
APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

APT28 has renamed the WinRAR utility to avoid detection.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT28 has used

Tor and a variety of commercial VPN services to route brute force authentication attempts.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1030|Data Transfer Size Limits|

APT28 has split archived exfiltration files into chunks smaller than 1MB.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1048.002|Exfiltration Over Asymmetric Encrypted Non-C2 Protocol|

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

APT28 has collected files from various information repositories.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|
APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

APT28 has collected files from network shared drives.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.003|NTDS|

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT28 has mapped network drives using

Net and administrator credentials.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Office 365,Google Workspace|T1098.002|Additional Email Delegate Permissions|

APT28 has used a Powershell cmdlet to grant the

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1588.002|Tool|
APT28 has obtained and used open-source tools like

Koadic,

Mimikatz, and

Responder.(Citation: Palo Alto Sofacy 06-2018)(Citation: Securelist Sofacy Feb 2018)(Citation: FireEye APT28 Hospitality Aug 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.(Citation: US District Court Indictment GRU Oct 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1589.001|Credentials|

APT28 has harvested user's login credentials.(Citation: Microsoft Targeting Elections September 2020)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1598|Phishing for Information|

APT28 has used spearphishing to compromise credentials.(Citation: Microsoft Targeting Elections September 2020)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1567|Exfiltration Over Web Service|

APT28 can exfiltrate data over Google Drive.(Citation: TrendMicro Pawn Storm Dec 2020) |
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1595.002|Vulnerability Scanning|

APT28 has performed large-scale scans in an attempt to find vulnerable servers.(Citation: TrendMicro Pawn Storm 2019)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

APT28 has routed traffic over

Tor and VPN servers to obfuscate their activities.(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|
APT28 has deployed malware that has copied itself to the startup directory for persistence.(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

APT28 has used Google Drive for C2.(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

APT28 can perform brute force attacks to obtain credentials.(Citation: TrendMicro Pawn Storm 2019)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Microsoft Targeting Elections September 2020)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1583.001|Domains|

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.(Citation: FireEye APT28)(Citation: US District Court Indictment GRU Oct 2018)(Citation: Google TAG Ukraine Threat Landscape March 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1498|Network Denial of Service|In 2016,

APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.(Citation: US District Court Indictment GRU Oct 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.(Citation: US District Court Indictment GRU Oct 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110.001|Password Guessing|

APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days.(Citation: Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020)

APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks.(Citation: Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020)(Citation: Microsoft Targeting Elections September 2020)

APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

APT28 regularly deploys both publicly available (ex:
APT28 regularly deploys both publicly available (ex:

Mimikatz) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018)(Citation: US District Court Indictment GRU Oct 2018)  |
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|Later implants used by

APT28, such as

CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.(Citation: FireEye APT28)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT28 has used the WindowStyle parameter to conceal

PowerShell windows.(Citation: Palo Alto Sofacy 06-2018) (Citation: McAfee APT28 DDE1 Nov 2017)|
|mitre-attack|enterprise-attack,mobile-attack|SaaS,Office 365,Azure AD,Google Workspace,Containers|T1528|Steal Application Access Token|

APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".(Citation: Trend Micro Pawn Storm OAuth 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Office 365,SaaS,Google Workspace,Containers,IaaS,Azure AD|T1550.001|Application Access Token|

APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.(Citation: Trend Micro Pawn Storm OAuth 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|
APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.(Citation: ESET Zebrocy May 2019)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1221|Template Injection|

APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro. (Citation: Unit42 Sofacy Dec 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.(Citation: Securelist Sofacy Feb 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1014|Rootkit|

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as

LoJax.(Citation: Symantec APT28 Oct 2018)(Citation: ESET LoJax Sept 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

APT28 has collected emails from victim Microsoft Exchange servers.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1059.001|PowerShell|

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.(Citation: Palo Alto Sofacy 06-2018)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1560|Archive Collected Data|
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.(Citation: DOJ GRU Indictment Jul 2018)(Citation: ESET Zebrocy May 2019)(Citation: US District Court Indictment GRU Oct 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|Once

APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1211|Exploitation for Defense Evasion|

APT28 has used CVE-2015-4902 to bypass security features.(Citation: Bitdefender APT28 Dec 2015)(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Office 365|T1213.002|Sharepoint|
APT28 has collected information from Microsoft SharePoint services within target networks.(Citation: RSAC 2015 Abu Dhabi Stefano Maccaglia)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Securelist Sofacy Feb 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

APT28 has saved files with hidden file attributes.(Citation: Talos Seduploader Oct 2017)(Citation: Talos Seduploader Oct 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1059.003|Windows Command Shell|An

APT28 loader Trojan uses a cmd.exe and batch script to run its payload.(Citation: Unit 42 Playbook Dec 2017) The group has also used macros to execute payloads.(Citation: Talos Seduploader Oct 2017)(Citation: Unit42 Cannon Nov 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|An

APT28 macro uses the command