Latest APT28 news

Microsoft: APT28 hackers exploit Windows flaw reported by NSA

Microsoft warns that the Russian APT28 threat group exploits a Windows Print Spooler vulnerability to escalate privileges and steal credentials and data using a previously unknown hacking tool called GooseEgg.
- Sergiu Gatlan
- April 22, 2024
- 01:22 PM
- 0
Russian hackers hijack Ubiquiti routers to launch stealthy attacks

Russian APT28 military hackers are using compromised Ubiquiti EdgeRouters to evade detection, the FBI says in a joint advisory issued with the NSA, the U.S. Cyber Command, and international partners.
- Sergiu Gatlan
- February 27, 2024
- 12:25 PM
- 0
FBI disrupts Russian Moobot botnet infecting Ubiquiti routers

The FBI took down a botnet of small office/home office (SOHO) routers used by Russia's Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks.
- Sergiu Gatlan
- February 15, 2024
- 01:00 PM
- 3
Russian military hackers target Ukraine with new MASEPIE malware

Ukraine's Computer Emergency Response Team (CERT) is warning of a new phishing campaign that allowed Russia-linked hackers to deploy previously unseen malware on a network in under one hour.
- Bill Toulas
- December 28, 2023
- 12:43 PM
- 0
Russian military hackers target NATO fast reaction corps

Russian APT28 military hackers used Microsoft Outlook zero-day exploits to target multiple European NATO member countries, including a NATO Rapid Deployable Corps.
- Sergiu Gatlan
- December 07, 2023
- 05:20 PM
- 0
Russian hackers exploiting Outlook bug to hijack Exchange accounts

Microsoft's Threat Intelligence team issued a warning earlier today about the Russian state-sponsored actor APT28 (aka "Fancybear" or "Strontium") actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts and steal sensitive information.
- Bill Toulas
- December 04, 2023
- 03:14 PM
- 0
France says Russian state hackers breached numerous critical networks

The Russian APT28 hacking group (aka 'Strontium' or 'Fancy Bear') has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.
- Bill Toulas
- October 26, 2023
- 12:40 PM
- 0
Google links WinRAR exploitation to Russian, Chinese state hackers

Google says that several state-backed hacking groups have joined ongoing attacks exploiting a high-severity vulnerability in WinRAR, a compression software used by over 500 million users, aiming to gain arbitrary code execution on targets' systems.
- Sergiu Gatlan
- October 18, 2023
- 11:00 AM
- 0
CISA orders govt agencies to patch bugs exploited by Russian hackers

On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six more security flaws to its known exploited vulnerabilities (KEV) list.
- Sergiu Gatlan
- June 22, 2023
- 03:04 PM
- 0
Russian APT28 hackers breach Ukrainian govt email servers

A threat group tracked as APT28 and linked to Russia's General Staff Main Intelligence Directorate (GRU) has breached Roundcube email servers belonging to multiple Ukrainian organizations, including government entities.
- Sergiu Gatlan
- June 20, 2023
- 09:00 AM
- 0
Hackers use fake ‘Windows Update’ guides to target Ukrainian govt

The Computer Emergency Response Team of Ukraine (CERT-UA) says Russian hackers are targeting various government bodies in the country with malicious emails supposedly containing instructions on how to update Windows as a defense against cyber attacks.
- Bill Toulas
- April 30, 2023
- 10:07 AM
- 0
Google: Ukraine targeted by 60% of Russian phishing attacks in 2023

Google's Threat Analysis Group (TAG) has been monitoring and disrupting Russian state-backed cyberattacks targeting Ukraine's critical infrastructure in 2023.
- Bill Toulas
- April 20, 2023
- 02:47 PM
- 0
US, UK warn of govt hackers using custom malware on Cisco routers

The US, UK, and Cisco are warning of Russian state-sponsored APT28 hackers deploying a custom malware named 'Jaguar Tooth' on Cisco IOS routers, allowing unauthenticated access to the device.
- Lawrence Abrams
- April 18, 2023
- 05:42 PM
- 1
Microsoft shares tips on detecting Outlook zero-day exploitation

Microsoft today published a detailed guide aiming to help customers discover signs of compromise via exploitation of a recently patched Outlook zero-day vulnerability.
- Sergiu Gatlan
- March 24, 2023
- 04:09 PM
- 0
Microsoft fixes Outlook zero-day used by Russian hackers since April 2022

Microsoft has patched an Outlook zero-day vulnerability (CVE-2023-23397) exploited by a hacking group linked to Russia's military intelligence service GRU to target European organizations.
- Sergiu Gatlan
- March 14, 2023
- 03:11 PM
- 3
Hackers use PowerPoint files for 'mouseover' malware delivery

Hackers believed to work for Russia have started using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations to trigger a malicious PowerShell script.
- Bill Toulas
- September 26, 2022
- 02:40 PM
- 4
Russian govt hackers hit Ukraine with Cobalt Strike, CredoMap malware

The Ukrainian Computer Emergency Response Team (CERT) is warning that Russian hacking groups are exploiting the Follina code execution vulnerability in new phishing campaigns to install the CredoMap malware and Cobalt Strike beacons.
- Bill Toulas
- June 21, 2022
- 03:34 PM
- 0
Microsoft takes down APT28 domains used in attacks against Ukraine

Microsoft has successfully disrupted attacks against Ukrainian targets coordinated by the Russian APT28 hacking group after taking down seven domains used as attack infrastructure.
- Sergiu Gatlan
- April 07, 2022
- 06:52 PM
- 1
Google: Russia, China, Belarus state hackers target Ukraine, Europe

Google says Russian, Belarusian, and Chinese threat actors targeted Ukrainian and European government and military organizations, as well as individuals, in sweeping phishing campaigns and DDoS attacks.
- Sergiu Gatlan
- March 08, 2022
- 06:21 AM
- 3
Void Balaur hackers-for-hire sell stolen mailboxes and private data

A hacker-for-hire group called Void Balaur has been stealing emails and highly-sensitive information for more than five years, selling it to customers with both financial and espionage goals
- Ionut Ilascu
- November 10, 2021
- 07:31 PM
- 0