The Grizzly Steppe Report (Unmasking the Russian Cyber Activity). Federal Bureau of Investigation

from their targets.

      In summer 2015, an APT29 spearphishing campaign directed emails containing a malicious link to over 1,000 recipients, including multiple U.S. Government victims. APT29 used legitimate domains, to include domains associated with U.S. organizations and educational institutions, to host malware and send spearphishing emails. In the course of that campaign, APT29 successfully compromised a U.S. political party. At least one targeted individual activated links to malware hosted on operational infrastructure of opened attachments containing malware. APT29 delivered malware to the political party’s systems, established persistence, escalated privileges, enumerated active directory accounts, and exfiltrated email from several accounts through encrypted connections back through operational infrastructure.

      In spring 2016, APT28 compromised the same political party, again via targeted spearphishing. This time, the spearphishing email tricked recipients into changing their passwords through a fake webmail domain hosted on APT28 operational infrastructure. Using the harvested credentials, APT28 was able to gain access and steal content, likely leading to the exfiltration of information from multiple senior party members. The U.S. Government assesses that information was leaked to the press and publicly disclosed.

       Figure 2: APT28's Use of Spearphishing and Stolen Credentials

      Actors likely associated with RIS are continuing to engage in spearphishing campaigns, including one launched as recently as November 2016, just days after the U.S. election.

Alternate Names

APT28

APT29

Agent.btz

BlackEnergy V3

BlackEnergy2 APT

CakeDuke

Carberp

CHOPSTICK

CloudDuke

CORESHELL

CosmicDuke

COZYBEAR

COZYCAR

COZYDUKE

Crouching Yeti

DIONIS

Dragonfly

Energetic Bear

EVILTOSS

Fancy Bear

GeminiDuke

GREY CLOUD

HammerDuke

HAMMERTOSS

Havex

MiniDionis

MiniDuke

OLDBAIT

OnionDuke

Operation Pawn Storm

PinchDuke

Powershell backdoor

Quedagh

Sandworm

SEADADDY

Seaduke

SEDKIT

SEDNIT

Skipper

Sofacy

SOURFACE

SYNful Knock

Tiny Baron

Tsar Team

twain_64.dll (64-bit X-Agent implant)

VmUpgradeHelper.exe (X-Tunnel implant)

Waterbug

X-Agent