APT28__2016__eset-sednit-part-2.pdf

ESET's whitepaper documents Sednit (APT28/Fancy Bear) espionage operations since 2014, analyzing three core tools: Xagent (modular multi‑platform backdoor with HTTP and email C2), Sedreco (plugin-capable Windows backdoor using file-buffered async C2), and Xtunnel (TLS-wrapped pivot/proxy for reaching internal hosts). The report includes source-code analysis, communication protocols, rollout/persistence workflows, IOCs (hashes, domains, IPs, filenames, mutexes, registry keys), and observed use against high-value geopolitical targets.