Sofacy APT hits high profile targets with updated toolset - Securelist

Kaspersky's GReAT details Sofacy (APT28/Fancy Bear) activity in 2015: modular AZZY backdoors and external C2 helper DLLs, rapid multi-stage deployment (including zero-days), and new USB-stealer modules targeting high-value and air-gapped systems; the report includes technical analysis, MD5s of samples, and C2 hostnames to support detection and response.