Targeting and compromise of french entities using the APT28 intrusion set

ANSSI warns that the APT28 intrusion set has repeatedly targeted and compromised French governmental, defence, research, and private-sector entities since 2021, using phishing, exploitation of CVE-2023-23397, brute-force and compromised edge devices to deploy backdoors (e.g., HeadLace) and stealers (e.g., OceanMap), often leveraging free hosting and temporary infrastructure; the bulletin details infection chains, victimology, notable campaigns, and references for mitigation.