Threat actor
APT28
Tracked by CyberSIXT since 7 Apr · last activity 22 Oct
- CVEs linked · all time
- 9
- in CISA KEV · all time
- 7
- articles · all time
- 29
2 articles since 11 Sep.
Show as table
| Day (UTC) | Articles |
|---|---|
| Tue 20 Oct | 1 |
| Thu 22 Oct | 1 |
CVEs
9 CVEsCVE-2024-1709ConnectWise ScreenConnect Authentication Bypass VulnerabilityCVSS10.0CriticalExploited99.9%EPSS1article
CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited25%EPSS11articles
CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited16%EPSS15articles
CVE-2024-1708ConnectWise ScreenConnect Path Traversal VulnerabilityCVSS8.4HighExploited95%EPSS4articles
CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityCVSS7.8HighExploited71%EPSS22articles
CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityCVSS6.5MediumExploited20%EPSS3articles
CVE-2026-32202Microsoft Windows Protection Mechanism Failure VulnerabilityCVSS4.3MediumExploited4.9%EPSS6articles
CVE-2026-8496A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7CVSS6.1Medium–Not in KEV0.4%EPSS1article
- Fancy Bear Used Webhook.site to Breach European Defence TargetsSecurityOnline
- APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long IntrusionThe Hacker News
- BlueDelta APT deploys HOOKEDGE backdoor via malicious Word macrosSecurity Affairs
- APT28 Uses HOOKEDGE Backdoor to Spy on European Govt NetworksThe Hacker News
- Leak shows Moscow university training cyber troops for Russiadti.domaintools.com
- WiFi attacks steal Microsoft 365 logins via DNS spoofingSecurityWeek
- GRU hackers use compromised routers to spy on UK officialsdti.domaintools.com
- APT28’s PixyNetLoader uses PNG steganography to hide malwareSecurityOnline
- Polish water plants breached by Russian APT via weak passwordsSecurity Affairs
- AI Powered Scams Rise as Deepfake Calls Cost Firms MillionsSOCRadar
- CISA Flags Actively Exploited CVE-2024-1708 and Windows FlawThe Hacker News
- Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof FlawThe Hacker News
- APT28 exploits Windows SmartScreen gap for zero click LNK attacksSecurityWeek
- RegPhantom Rootkit Lets Attackers Gain Kernel Access on WindowsThe Hacker News
- Malicious npm Strapi Packages Spread Redis RCE and Steal DataSecurity Affairs
- Trend Micro Exposes Fancy Bears Prismex Malware Targeting UkraineDark Reading
- APT28's Year Long Router Hijacking Campaign Exposes World TrafficDark Reading
- Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tacticsSecurity Affairs
- APT28 Deploys New PRISMEX Malware Against Ukraine and NATO AlliesThe Hacker News
- UK warns Russian hackers hijack home routers for spyingMalwarebytes
- APT28 hijacks routers worldwide to steal passwords via DNS attackDataBreaches
- Russian APT28 hijacks home routers to steal credentialsArs Technica
- US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS HijackingSecurityWeek
- US and FBI shut down Russian hackers' router hijacking networkInfosecurity
- APT28 hijacks routers worldwide in DNS based FrostArmada campaignThe Hacker News
- APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentialsInfosecurity
- Forest Blizzard hijacks routers to spy via AI enabled DNS attacksMicrosoft
- NCSC Warns Russian APT28 Hijacks Routers for DNS AttacksNCSC · official notice
- APT28 exploits routers to redirect DNS, stealing credentialsNCSC · first in our coverage · official notice