apt28

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Ad

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or serv

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is

Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated wit

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of informati

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote system

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from an

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on beh

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control ch

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

ADVSTORESHELL is a spying backdoor that has been used by APT28 fro

CHOPSTICK is a malware family of modular backdoors used by APT28.

Cannon is a Trojan with variants written in C# and Delphi. It was first observed in April 2018. (Citation:

CORESHELL is a downloader used by APT28. The older versions of thi

DealersChoice is a Flash exploitation framework used by APT28. (Ci

Downdelph is a first-stage downloader written in Delphi that has been used by [APT28](https://attack.mitre.

Drovorub is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has bee

Forfiles is a Windows utility commonly used in batch jobs to execute commands on one or more selected files

Fysbis is a Linux-based backdoor used by APT28 that dates back to

HIDEDRV is a rootkit used by APT28. It has been deployed along wit

JHUHUGIT is malware used by APT28. It is based on Carberp source c

Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on

Komplex is a backdoor that has been used by APT28 on OS X and appe

LAMEHUG is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency R

LoJax is a UEFI rootkit used by APT28 to persist remote access sof

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

OLDBAIT is a credential harvester used by APT28. (Citation: FireEy

Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporti

Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-h

USBStealer is malware that has been used by APT28 since at least 2

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event

Winexe is a lightweight, open source tool similar to PsExec desi

XAgentOSX is a trojan that has been used by APT28 on OS X and app

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first

Zebrocy is a Trojan that has been used by APT28 since at least Nov

certutil is a command-line utility that can be used to obtain certificate authority information and configu

cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Tech

reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules

APT28 Nearest Neighbor Campaign was conducted by APT28 from early