APT28
Nation-state Espionage Russia Active
Aliases: Fancy Bear · Sofacy · Sednit · Forest Blizzard · Strontium · Pawn Storm · Fighting Ursa
- Mentions
- 3
- First seen
- 12 Jul 2026
- Last seen
- 20 Oct 2026
Relevant to you · Relevant
- Threat focus:
- espionage / apt
- Sector / region:
- DACH
Origin
Russia — Russian military intelligence (GRU Unit 26165)
Profile
Recent reporting links APT28 to hacking of defense contractors in two NATO allied countries. Russia's FSB is blamed for an attack on Poland's power grid. In response, the UK and EU imposed first joint cyber sanctions. The activities are attributed to Russia.
Targeted sectors
Energydefenseenergy
Targeted regions
Europe
Targeted countries
Poland
Activity (8 weeks)
Recent activity
- Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader The Hacker News
- Defense contractors in two NATO allies hacked in recent Russia-linked campaign The Record from Recorded Future News
- Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions The Record from Recorded Future News