[tr1adx]: Intel

tr1adx Intelligence Bulletin TIB-00001 reports on active APT28 (Fancy Bear/Sofacy) activity: the actor is registering hundreds of domains impersonating legitimate services to support spearphishing and credential harvesting, then deploying Sofacy/Agent-X malware for persistence and command-and-control. The bulletin lists numerous targeted countries and sectors (military, government, NGOs, media, NATO/EU) and provides 130+ domain IOCs while withholding some extortion-related indicators.