APT28__2014__apt28.pdf

FireEye profiles APT28, a persistent espionage threat active since at least 2007 that targets Georgian, Eastern European, and NATO/security-related targets. The report documents spearphishing lures and domain impersonation, technical analysis of modular malware families (SOURFACE/CORESHELL downloader, EVILTOSS backdoor, CHOPSTICK modular implant, OLDBAIT credential harvester), C2 protocols and examples, compile-time and locale metadata linking development to Russian-language build environments and Moscow/St. Petersburg working hours, and concludes the activity is consistent with Russian government-sponsored intelligence collection.