Dark Web Profile: APT28

APT28, also known as Fancy Bear and Sofacy, is a long-tracked state-linked intrusion set widely attributed to Russia’s GRU and linked to Unit 26165. Public attributions through 2024 and 2025 have kept the group in focus, with campaigns spanning Europe, North America, and Ukraine-linked operations; reporting consistently points to intelligence collection as the core objective rather than financial gain.

The group has a long history of espionage against government, diplomatic, and military targets and has been associated with high-profile incidents affecting political organisations, media, and state bodies. Notable campaigns include LAMEHUG in 2025, which embedded LLM-enabled malware into Ukrainian government targets, and a credential and token theft drive against UKR[.]net users during 2024–2025, alongside the UK NCSC attribution of the AUTHENTIC ANTICS malware to APT28.

France publicly attributed intrusions observed since 2021, citing CVEs such as CVE-2023-23397, while Cisco router-focused activity in 2021 involved CVE-2017-6742 and about 250 Ukrainian victims.