APT28__2025__CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF.pdf

This joint advisory describes sustained, state-sponsored cyber-espionage operations by Russia’s GRU unit 26165 (APT28/Fancy Bear) targeting Western logistics and technology companies involved in aid to Ukraine. The report documents initial-access methods (credential guessing, spearphishing, exploited CVEs such as CVE-2023-23397 and CVE-2023-38831, and SOHO device abuse), post-compromise activity (mailbox permission manipulation, lateral movement with Impacket/PsExec, RDP, NTDS dumping), malware (HEADLACE, MASEPIE, others), large-scale targeting of IP cameras for tracking shipments, detailed IOCs and YARA detections, and recommended mitigations mapped to MITRE ATT&CK and D3FEND frameworks.