APT28__2015__cto-tib-20150420-01a.pdf

This PwC Tactical Intelligence Bulletin reports on recent Sofacy (APT28/Fancy Bear/Pawn Storm) activity: spear-phishing that leverages browser exploits (notably CVE-2015-3043 and CVE-2015-1701) to deploy malware and harvest web-mail credentials. The bulletin provides a TLP:WHITE appendix of domains observed or suspected to be used for phishing and command-and-control, and points to Trend Micro and FireEye reporting for further technical detail and indicators.