APT28__2015__R9b_FSOFACY_0.pdf

root9B reports detection of a pre-positioned Sofacy/APT28 campaign targeting financial institutions (notably a UAE bank and other global banks) that used fake banking domains and spear-phishing to stage attacks; investigators recovered multiple zero-day malware samples (SHA1 hashes listed) and a C2 IP (176.31.112.10) and enumerated ~250 malicious domains, attributing high sophistication and likely Russian intelligence linkage while recommending blocking the provided hashes and C2 communications.