APT28

APT28 is one of the most extensively documented state-linked cyber threat actors, attributed by multiple Western governments and private security firms to Russia's military intelligence agency, the GRU (specifically Unit 26165 of the GRU's 85th Main Special Service Center). The group has been tracked under various names by different vendors: Fancy Bear (CrowdStrike), Sofacy (Kaspersky), Sednit (ESET), STRONTIUM and later Forest Blizzard (Microsoft), and Pawn Storm (Trend Micro).

Active since at least the mid-2000s, APT28 specializes in cyber-espionage and information operations targeting governments, militaries, defense contractors, journalists, dissidents, and international organizations. Its toolkit has historically included custom malware families such as X-Agent, X-Tunnel, Sofacy/SOURFACE, CHOPSTICK, and the LoJax UEFI rootkit, alongside spear-phishing and credential-harvesting infrastructure.

Notable incidents attributed to APT28 include:

• The 2015 breach of the German Bundestag, confirmed by Germany's BfV.
• The 2016 intrusion into the U.S. Democratic National Committee, detailed in the July 2018 indictment of seven GRU officers by U.S. Special Counsel Robert Mueller.
• Attempted intrusions against the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague in April 2018, after which the Dutch MIVD publicly expelled four GRU officers.
• Targeting of the World Anti-Doping Agency (WADA) and the International Olympic Committee following Russia's doping scandal.
• Phishing campaigns against the 2017 French presidential campaign of Emmanuel Macron.

In 2020 the EU imposed sanctions on individuals and the GRU's 85th GTsSS under its cyber-sanctions regime in connection with the Bundestag hack. APT28 is frequently cited in MUN and policy debates on attribution, deterrence, and the application of international law to state-sponsored cyber operations.