Since February 2022, APT28 has focused heavily on Western logistics and technology companies coordinating aid to Ukraine. A May 2025 joint advisory from CISA and 12 allied agencies confirmed a two-year campaign targeting rail operators, air traffic control, maritime logistics, and ICS component manufacturers across NATO nations. Their objective is intelligence on supply routes and infrastructure supporting Ukrainian defense.

They continue to operate a dual-track approach: mass credential harvesting campaigns (password spraying, OAuth phishing) alongside targeted exploitation of specific vulnerabilities. In 2024, Microsoft disclosed that APT28 had been using a custom privilege escalation tool called GooseEgg since at least 2020, undetected for four years. In mid-2025, CERT-UA reported the LAMEHUG malware, the first documented APT28 tool integrating LLM capabilities for command generation.

APT28 is opportunistic and uses multiple simultaneous entry methods. They favor speed over sophistication at the initial access stage.

• CVE-2023-23397 Microsoft Outlook zero-click. Sends a specially crafted calendar invite that forces the victim's Outlook client to authenticate to an attacker-controlled SMB share, leaking the NTLMv2 hash. Zero user interaction required. APT28's signature vulnerability from 2022-2023.
• CVE-2022-38028 Windows Print Spooler. Exploited by GooseEgg for SYSTEM-level privilege escalation. Used since at least 2020, disclosed 2024.
• CVE-2023-38831 WinRAR code execution. Malicious archives exploiting the file extension handling flaw. Used in credential harvesting operations against Ukraine.
• CVE-2024-11182 MDaemon webmail XSS zero-day (Operation RoundPress). Cross-site scripting against webmail platforms to steal session tokens.
• Password spraying via compromised router botnets (MooBot, Ubiquiti edge routers). FBI disrupted the botnet in January 2024 ("Operation Dying Ember"). Spraying relayed through residential IPs to defeat rate limiting.
• Spearphishing with maldocs (Office macros, LNK files, RAR archives), OAuth consent phishing, and credential harvesting pages hosted on compromised infrastructure.
• Nearest Neighbor Attack (2022). Compromised Wi-Fi networks at organizations physically adjacent to the target to gain proximity access to the target's corporate wireless. Novel physical-proximity vector without being on-site.

Unlike Volt Typhoon (zero custom tools), APT28 maintains a deep custom arsenal. Identifying these tools on a host is near-certain attribution.

1. 1. Check for CVE-2023-23397 exploitation Search for Outlook calendar invites with UNC paths pointing to external IPs (\\<attacker_IP>\share). The exploit leaks NTLM hashes without user interaction. Check SMB traffic logs for outbound NTLM authentication to external IPs. Microsoft released a detection script: CVE-2023-23397 auditing tool. NET: Credential Access · Outlook message audit
2. 2. Hunt for GooseEgg artifacts Search Sysmon EID 1 for justice.exe, DefragmentSvc.exe, execute.bat, or doit.bat (documented GooseEgg filenames). Check scheduled tasks for entries running these binaries. GooseEgg modifies a JavaScript constraints file in the Print Spooler directory (DRIVERS\x64\3\) to achieve SYSTEM execution. HOST: Privilege Escalation · Sysmon EID 1 + EID 11
3. 3. Check for Drovorub on Linux hosts Run lsmod vs /sys/module/ discrepancy check (hidden kernel modules). Search for the Drovorub agent process and its configuration file. Drovorub hides files, processes, and network ports from userland tools. Volatile memory analysis (Volatility linux_check_modules) is the most reliable detection. HOST: T1547.006 Kernel Module · NSA/FBI Drovorub advisory
4. 4. Search for password spraying indicators High-volume failed authentication (Security EID 4625) from distributed source IPs, particularly residential IP ranges (compromised router botnet). Look for spraying patterns: same password attempted against many accounts in sequence, or low-and-slow patterns (1-2 attempts per account per day to avoid lockout). HOST: Credential Access · Security EID 4625 · VPN/Azure AD sign-in logs
5. 5. Audit Exchange mailbox permissions APT28 modifies mailbox folder permissions to maintain persistent email access without re-authenticating. Check for: FullAccess or Editor permissions added to mailboxes, mail forwarding rules to external addresses, and OAuth app consent grants. Use Get-MailboxFolderPermission and Get-InboxRule across all mailboxes. Compromised Credentials playbook · Exchange audit logs
6. 6. Check for steganography in downloaded images APT28 conceals shellcode in PNG files using LSB (Least Significant Bit) encoding. Search for: PowerShell scripts that download and process image files, unusual image processing in process command lines, and PNG files in staging directories that are larger than expected for their resolution. HOST: Defense Evasion · Sysmon EID 11 (FileCreate) for .png in temp paths
7. 7. Hunt for OCEANMAP IMAP C2 OCEANMAP uses IMAP email drafts for command and control. Search for: .NET processes making persistent IMAP connections (port 993) to external mail servers, processes maintaining long-lived connections to mail infrastructure without sending visible email. The draft-based C2 generates no outbound email traffic, only IMAP session activity. NET: C2 · Sysmon EID 3 to port 993
8. 8. Check for credential harvesting tools STEELHOOK (PowerShell, targets Chrome encryption keys and passwords), CredoMap (browser credential stealer), and standard Mimikatz/LSASS access. APT28 aggressively harvests credentials early in the intrusion. Search for browser credential database access and LSASS process access. HOST: T1555.003 Browser Creds · T1003.001 LSASS
9. 9. Check persistence: scheduled tasks, startup folders, COM hijacking APT28 uses scheduled tasks (GooseEgg persistence), malicious LNK/BAT files in startup folders, and COM object hijacking for persistence. Check: schtasks /query for unusual entries, Startup folder contents, and registry COM hijack keys (HKCU\Software\Classes\CLSID). HOST: Persistence · Sysmon EID 12/13 registry · Autoruns
10. 10. Check for data exfiltration via cloud storage or email APT28 exfiltrates via HTTPS uploads to cloud storage, PowerShell-based data preparation (Compress-Archive), and email-based C2 channels (OCEANMAP). Search for: large outbound HTTPS sessions, PowerShell archive creation targeting sensitive directories, and unusual IMAP/SMTP traffic volumes. NET: Exfiltration · C2

APT28 (GRU 26165) vs APT29 (SVR). APT28 is noisier, faster, and more aggressive. They use custom exploitation tools (GooseEgg), mass credential harvesting campaigns, and are willing to burn infrastructure for speed. APT29 is quieter, more patient, favors supply-chain access and cloud-native operations, and maintains longer dwell times. If the intrusion feels rushed and noisy with lots of credential phishing, it's more likely APT28. If it's quiet with no malware and cloud-focused, it's more likely APT29.

APT28 vs Sandworm (GRU 74455). Both are GRU but different units with different missions. APT28 does espionage. Sandworm does destruction (NotPetya, Industroyer, wipers). They occasionally collaborate (2018 WADA/OPCW operations). If the objective appears to be intelligence collection, it's APT28. If the objective is disruption or destruction of infrastructure, it's Sandworm.

Signature APT28 indicators: CVE-2023-23397 exploitation (unique to APT28 at scale), GooseEgg on disk, X-Agent/Sofacy implant, Drovorub on Linux, OCEANMAP IMAP C2, residential-IP password spraying, and steganographic PNG payloads. Any of these are high-confidence APT28.

CISA AA25-141A (May 2025): GRU Unit 26165 targeting Western logistics and technology companies.
Microsoft GooseEgg disclosure (April 2024): Custom Print Spooler exploitation tool, in use since 2020.
FBI Operation Dying Ember (January 2024): Disruption of MooBot/Ubiquiti router botnet used for password spraying relay.
NSA/FBI Drovorub advisory (August 2020): Linux rootkit detection and mitigation guidance.
ESET LoJax report (September 2018): First documented in-the-wild UEFI rootkit.

Compromised Credentials (APT28's primary initial access is credential theft)
C2 Beacon Found (X-Agent, OCEANMAP, and GooseEgg all establish C2 channels)
Living-off-the-Land Activity (APT28's post-GooseEgg lateral movement increasingly uses native tools)
Volt Typhoon (comparison: opposite operational style, same router-botnet relay concept)