APT28__2025__CERTFR-2025-CTI-007.pdf

ANSSI (Apr 29, 2025) reports that the APT28 intrusion set has been actively targeting and compromising French entities since 2021 for espionage purposes; campaigns use phishing, exploitation (including CVE-2023-23397), brute-force, and compromised edge devices, leveraging low-cost outsourced infrastructure and malware (e.g., HeadLace, OceanMap stealer) to exfiltrate credentials and emails while primarily affecting government, DTIB, aerospace, research and financial sectors.