cyber_threat_intelligence/actors/APT28/README.md

APT28 - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as APT28. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.apt28

Campaigns

The following campaigns are known and can be associated with APT28:

• Carberp
• CVE-2022-30190
• CVE-2023-23397
• ...

There are 6 more campaign items available. Please use our online service to access the data.

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with APT28:

• VN
• RO
• CN
• ...

There are 2 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of APT28.

ID	IP address	Hostname	Campaign	Confidence
1	5.63.153.177	5-63-153-177.ovz.vps.regruhosting.ru	-	High
2	5.100.155.82	5.100.155-82.publicdomainregistry.com	-	High
3	5.100.155.91	5.100.155-91.publicdomainregistry.com	-	High
4	5.135.183.154	ns3290077.ip-5-135-183.eu	Sednit	High
5	5.199.162.132	-	CVE-2023-23397	High
6	5.199.171.58	-	-	High
7	12.94.8.230	-	-	High
8	12.171.204.129	-	-	High
9	14.198.168.140	014198168140.ctinets.com	CVE-2023-23397	High
10	18.130.154.13	ec2-18-130-154-13.eu-west-2.compute.amazonaws.com	-	Medium
11	18.133.205.135	ec2-18-133-205-135.eu-west-2.compute.amazonaws.com	-	Medium
12	18.133.249.238	ec2-18-133-249-238.eu-west-2.compute.amazonaws.com	-	Medium
13	23.24.68.109	23-24-68-109-static.hfc.comcastbusiness.net	-	High
14	23.88.228.248	-	-	High
15	23.163.0.59	naomi.rem2d.com	-	High
16	23.227.196.21	23-227-196-21.static.hvvc.us	-	High
17	23.227.196.215	23-227-196-215.static.hvvc.us	-	High
18	23.227.196.217	23-227-196-217.static.hvvc.us	-	High
19	24.11.70.85	c-24-11-70-85.hsd1.ut.comcast.net	-	High
20	24.142.165.2	024-142-165-002.biz.spectrum.com	CVE-2023-23397	High
21	31.184.198.23	-	-	High
22	31.184.198.38	-	-	High
23	31.220.43.99	-	Sednit	High
24	31.220.61.251	-	-	High
25	37.235.52.18	18.52.235.37.in-addr.arpa	-	High
26	42.98.5.225	42-98-5-225.static.netvigator.com	CVE-2023-23397	High
27	45.32.129.185	45.32.129.185.vultr.com	-	Medium
28	45.32.227.21	45.32.227.21.mobiltel.mx	-	High
29	45.64.105.23	-	-	High
30	45.83.90.11	-	CVE-2023-23397	High
31	45.91.95.181	sks3.simoxap.xyz	CVE-2023-23397	High
32	45.124.132.127	-	-	High
33	46.19.138.66	ab2.alchibasystems.in.net	-	High
34	46.21.147.55	46-21-147-55.static.hvvc.us	-	High
35	46.21.147.71	46-21-147-71.static.hvvc.us	-	High
36	46.21.147.76	46-21-147-76.static.hvvc.us	-	High
37	46.148.17.227	-	-	High
38	46.166.162.90	-	Pawn Storm	High
39	46.183.217.74	ip-217-74.dataclub.info	Pawn Storm	High
40	50.173.136.70	c-50-173-136-70.unallocated.comcastbusiness.net	CVE-2023-23397	High
41	51.38.128.110	vps-0a3489af.vps.ovh.net	-	High
42	51.254.76.54	-	-	High
43	51.254.158.57	-	-	High
44	54.37.104.106	piber.connectedlists.com	-	High
45	58.49.58.58	-	-	High
46	61.14.68.33	-	CVE-2023-23397	High
47	61.68.76.111	61-68-76-111.tpgi.com.au	-	High
48	62.4.36.126	-	CVE-2023-23397	High
49	62.113.232.197	-	-	High
50	66.172.11.207	ip-66-172-11-207.chunkhost.com	Carberp	High
51	66.172.12.133	-	-	High
52	68.76.150.97	68-76-150-97.lightspeed.hstntx.sbcglobal.net	-	High
53	69.12.73.174	69.12.73.174.static.quadranet.com	Sednit	High
54	69.16.243.33	host.tecnode.com	-	High
55	69.28.64.137	-	-	High
56	69.51.2.106	-	CVE-2023-23397	High
57	69.162.253.21	69-162-253-21.utopiafiber.com	CVE-2023-23397	High
58	70.85.221.10	server002.nilsson-it.dk	-	High
59	70.85.221.20	14.dd.5546.static.theplanet.com	Pawn Storm	High
60	73.80.9.137	c-73-80-9-137.hsd1.nj.comcast.net	CVE-2023-23397	High
61	74.208.228.186	u17669945.onlinehome-server.com	CVE-2023-23397	High
62	...	...	...	...

There are 243 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by APT28. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Weakness	Description	Confidence
1	T1006	CWE-21, CWE-22, CWE-23, CWE-29	Path Traversal	High
2	T1055	CWE-74	Injection	High
3	T1059	CWE-94, CWE-1321	Argument Injection	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	High
5	...	...	...	...

There are 18 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by APT28. This data is unique as it uses our predictive model for actor profiling.

ID	Type	Indicator	Confidence
1	File	/.env	Low
2	File	/act/ActDao.xml	High
3	File	/admin/	Low
4	File	/admin/action/new-father.php	High
5	File	/admin/clientview.php	High
6	File	/admin/edit_teacher.php	High
7	File	/admin/fields/manage_field.php	High
8	File	/admin/regester.php	High
9	File	/admin/update-clients.php	High
10	File	/admin_ping.htm	High
11	File	/admin_route/dec_service_credits.php	High
12	File	/admin_route/inc_service_credits.php	High
13	File	/api/cron/settings/setJob/	High
14	File	/api/sys/set_passwd	High
15	File	/api/v1/terminal/sessions/?limit=1	High
16	File	/app/api/controller/default/Sqlite.php	High
17	File	/application/index/controller/Databasesource.php	High
18	File	/application/index/controller/Icon.php	High
19	File	/application/index/controller/Screen.php	High
20	File	/application/plugins/controller/Upload.php	High
21	File	/apply.cgi	Medium
22	File	/arch/x86/mm/cpu_entry_area.c	High
23	File	/authenticationendpoint/login.do	High
24	File	/b2b-supermarket/shopping-cart	High
25	File	/bin/boa	Medium
26	File	/boaform/device_reset.cgi	High
27	File	/boafrm/formMapDelDevice	High
28	File	/bsms_ci/index.php	High
29	File	/bsms_ci/index.php/user/edit_user/	High
30	File	/cgi-bin/cstecgi.cgi	High
31	File	/cgi-bin/cstecgi.cgi?action=login	High
32	File	/cgi-bin/kerbynet	High
33	File	/cgi-bin/koha/catalogue/search.pl	High
34	File	/cgi-bin/mainfunction.cgi	High
35	File	/cgi-bin/R14.2/cgi-bin/R14.2/host.pl	High
36	File	/cgi-bin/R14.2/easy1350.pl	High
37	File	/cgi-bin/wlogin.cgi	High
38	File	/clinic/disease_symptoms_view.php	High
39	File	/config/getuser	High
40	File	/core/redirect	High
41	File	/dashboard/message	High
42	File	/dashboard/snapshot/*?orgId=0	High
43	File	/debug/pprof	Medium
44	File	/DXR.axd	Medium
45	File	/ECT_Provider/	High
46	...	...	...

There are 401 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

• https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
• https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
• https://blog.malwarebytes.com/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine/
• https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/
• https://cert.gov.ua/article/40102
• https://cert.gov.ua/article/5702579
• https://community.blueliv.com/#!/s/5f6b482482df413eb5350d3b
• https://documents.trendmicro.com/assets/wp/wp-two-years-of-pawn-storm.pdf
• https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-05-ioc-mark.txt
• https://github.com/blackorbird/APT_REPORT/blob/master/APT28/IOC/2019-04-09-ioc-mark.txt
• https://github.com/blackorbird/APT_REPORT/blob/master/CyberMerceNary/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf
• https://github.com/fireeye/iocs/blob/master/APT28/e1cbf7ca-4938-4d3c-a7e6-3ff966516191.ioc
• https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/
• https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
• https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
• https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/
• https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
• https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/2015.11.04_Evolving_Threats/cct-w08_evolving-threats-dissection-of-a-cyber-espionage-attack.pdf
• https://twitter.com/teamcymru_S2/status/1540390942510927873
• https://twitter.com/teamcymru_S2/status/1540390947665616897
• https://twitter.com/teamcymru_S2/status/1540390955882319876
• https://unit42.paloaltonetworks.com/a-look-into-fysbis-sofacys-linux-backdoor/
• https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/
• https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/
• https://unit42.paloaltonetworks.com/unit42-new-sofacy-attacks-against-us-government-agency/
• https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
• https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
• https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/
• https://unit42.paloaltonetworks.com/unit42-xagentosx-sofacys-xagent-macos-tool/
• https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50
• https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
• https://www.ncsc.gov.uk/files/NCSC_APT28.pdf
• https://www.threatminer.org/report.php?q=ASongofIntelandFancy_ExploitingFancyBear%E2%80%99suseofSSLcertificate.pdf&y=2018
• https://www.threatminer.org/report.php?q=eset-sednit-part-2-ESET.pdf&y=2016
• https://www.threatminer.org/report.php?q=eset-sednit-part1-ESET.pdf&y=2016
• https://www.threatminer.org/report.php?q=FancyBearcontinuetooperatethroughphishingemailsandmuchmore_ESET.pdf&y=2017
• https://www.threatminer.org/report.php?q=OperationRussianDoll.pdf&y=2015
• https://www.threatminer.org/report.php?q=TheDeceptionProjectANewJapanese-CentricThreat-Cylance.pdf&y=2017
• https://www.threatminer.org/report.php?q=ThreatConnectandFidelisTeamUptoExploretheDCCCBreach-ThreatConnect.pdf&y=2016
• https://www.threatminer.org/report.php?q=ThreatConnectIdentifiesFANCYBEARWorldAnti-DopingAgencyBreach-ThreatConnect.pdf&y=2016
• https://www.threatminer.org/report.php?q=wp-operation-pawn-storm.pdf&y=2014
• https://www.trendmicro.com/en_us/research/24/a/pawn-storm-uses-brute-force-and-stealth.html
• https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/
• https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
• https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf
• https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

Literature

The following articles explain our unique predictive cyber threat intelligence:

• VulDB Cyber Threat Intelligence Documentation
• Cyber Threat Intelligence - Early Anticipation of Attacks

License

(c) 1997-2024 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!