D
CyberRussia

APT28

State-sponsored cyber threat groupActivePending verification

Also known as: Fancy Bear, Forest Blizzard, Sofacy, Sednit, STRONTIUM

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsFancy Bear, Forest Blizzard, Sofacy, Sednit, STRONTIUM
ProliferationOrigin country only
Active since2004At least 2004Med[1]
MITRE ATT&CK IDG0007High[1]
Attribution and activity
Attributed sponsorGRU 85th GTsSS, military unit 26165Med[1]
TargetsGovernments, militaries, political campaigns, international organizationsMed[1]
Notable activity2016 DNC compromise; Nearest Neighbor campaign (2022–2024)Med[1]
Summary

Cyber threat group attributed to Russia's GRU 85th Main Special Service Center (GTsSS), military unit 26165.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. APT28, Group G0007, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-10-03
Change log
  • 2026-10-03 Initial draft entry from cited open sources
  • 2026-10-03 Added identification art