APT28

⚠2 designators are marked partial — the vendor's cluster overlaps this group but is not synonymous with it. Treating a partial correlation as an equivalence is the most common source of attribution error when pivoting between vendor reports.

1. 01

   Reconnaissance

   1 technique

   Harvests defence, government and logistics mailboxes at scale ahead of a campaign — the target list is assembled before any infrastructure is stood up.

   • T1589.002Gather Victim Identity Information: Email Addresses
2. 02

   Resource Development

   1 technique

   Registers typosquatted webmail and SSO portals on short-lived VPS, burning and replacing them faster than blocklists propagate.

   • T1583.001Acquire Infrastructure: Domains
3. 03

   Initial Access

   3 techniques

   Two modes, run in parallel. Credential phishing against Outlook Web Access and government SSO for volume, and genuine zero-day exploitation when a target justifies it — CVE-2023-23397 required no user interaction at all, leaking the credential hash the moment the message arrived.

   • T1566.002Phishing: Spearphishing Link
   • T1566.001Phishing: Spearphishing Attachment
   • T1190Exploit Public-Facing Application
4. 04

   Execution

   1 technique·derived

   Exploitation for Client Execution.

   • T1203Exploitation for Client Execution
5. 05

   Persistence

   2 techniques

   Scheduled tasks on Windows, firmware on the machines that matter.

   • T1542.001Pre-OS Boot: System Firmware
   • T1053.005Scheduled Task/Job: Scheduled Task
6. 06

   Privilege Escalation

   1 technique

   GooseEgg exploits Print Spooler for SYSTEM, a capability Microsoft assessed the group had been running since 2019 — more than three years before the flaw was patched.

   • T1068Exploitation for Privilege Escalation
7. 07

   Defense Evasion

   1 technique

   Persists below the operating system where necessary. LoJax writes to SPI flash and survives disk replacement; Drovorub hides its own artifacts from a running Linux kernel.

   • T1014Rootkit
8. 08

   Credential Access

   3 techniques

   Coerces authentication rather than asking for it. A UNC path in a calendar invite forces Outlook to authenticate to attacker SMB infrastructure; a Kubernetes cluster sprays passwords across cloud tenants at industrial scale.

   • T1110.003Brute Force: Password Spraying
   • T1187Forced Authentication
   • T1555.003Credentials from Password Stores: Credentials from Web Browsers
9. 09

   Lateral Movement

   1 technique

   Pass-the-hash using the Net-NTLMv2 material gathered during forced authentication, so movement continues without ever cracking a password.

   • T1550.002Use Alternate Authentication Material: Pass the Hash
10. 10

    Collection

    1 technique

    Mailboxes and documents from the specific offices — a defence ministry, an anti-doping laboratory, a rail operator moving aid — whose contents serve the operation's political objective.

    • T1114.002Email Collection: Remote Email Collection
11. 11

    Command and Control

    2 techniques

    OCEANMAP retrieves commands from IMAP mailbox drafts, so C2 is indistinguishable from a user's own mail client synchronising.

    • T1071.003Application Layer Protocol: Mail Protocols
    • T1102.002Web Service: Bidirectional Communication
12. 12

    Exfiltration

    1 technique

    Staged out over alternative protocols, then frequently published — through DCLeaks, Guccifer 2.0, or Fancy Bears' Hack Team — because for this actor the leak, not the collection, is often the objective.

    • T1048Exfiltration Over Alternative Protocol
13. 13

    Impact

    1 technique

    Rare. Where APT28 causes effect it is informational rather than destructive; the GRU's disruptive work belongs to Unit 74455.

    • T1657Financial Theft

Scroll horizontally · characteristic chain across documented operations, not a single incident