Pawn Storm in 2019: A Year of Scanning and Credential Phishing on High-Profile Targets

Trend Micro documents Pawn Storm (APT28/Fancy Bear) operations from 2017–2020, highlighting large-scale credential-phishing campaigns using compromised high-profile email accounts and commercial VPNs, prolific scanning and probing of webmail/Exchange Autodiscover and services on ports such as 443, 445 and 1433, and tracking via DNS SPF requests; the report includes IoCs (IPs and domains), campaign timelines, and defensive recommendations.