APT28: A Window into Russia's Cyber Espionage Operations

FireEye's report profiles APT28, a long-running, highly capable espionage group assessed to be sponsored by the Russian government that has targeted Georgian and Eastern European government and military organizations, NATO and other security bodies, journalists, and defense exhibitions; the analysis details modular malware families (SOURFACE/CORESHELL downloader, EVILTOSS backdoor, CHOPSTICK modular implant, OLDBAIT credential stealer), spearphishing lures and domain impersonation tactics, observed indicators of compromise, and metadata (Russian language PE resources and compile times) used to support attribution.