APT28__2018__4OctoberIOC-APT28-malware-advisory.pdf

This NCSC advisory documents APT28 (Fancy Bear) malware tools (X‑Agent, X‑Tunnel, CompuTrace/Lojack, Zebrocy), describing their capabilities (keylogging, file theft, persistence, tunnelling) and providing actionable Indicators of Compromise—IP addresses, domains, file hashes—and Snort detection signatures, along with recommended mitigations such as deploying SysMon, managing macros, and improving phishing defenses.