APT28__2017__A_Slice_of_2017_Sofacy_Activity_-_Securelist.pdf
ID: b9dc52d9-023b-482c-8ea5-34aa163a1a6c
STIX ID: report--b9dc52d9-023b-482c-8ea5-34aa163a1a6c
Threat Score
90/100
Uploaded: 2026-08-07
Published Date: 2018-02-21
Last Modified Date: 2018-02-21
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
This report profiles Sofacy (APT28), documenting multiple 2017 campaigns that used zero-day Office exploits, modular backdoors (SPLM/XAgent), Zebrocy/AutoIt delivery chains, and a GAMEFISH implant; it details targeting (NATO, Ukraine, Central Asia, Middle East), infrastructure patterns, numerous MD5 hashes and related domains, observed data-stealing functionality, and recommended detection/mitigation steps.