Campagnes d'attaques du mode opératoire APT28 depuis 2021

ANSSI presents a technical analysis of APT28 (Fancy Bear) campaigns from 2021–2023: describing reconnaissance (credential harvesting, brute force), initial access (phishing, mail-client exploits), exploitation (notably CVE-2023-23397), use of compromised routers/mail accounts for pivoting and exfiltration, observed malware and tools (Graphite, CredoMap, Mimikatz, reGeorg), IoCs (emails, file hashes, IPs), and comprehensive mitigations for email, authentication, endpoints and web access.