Full Report
The French foreign ministry has attributed a series of cyberattacks on national interests to APT28, a group linked... The post French Foreign Ministry blames Russian GRU-linked APT28 for cyberattacks on national entities; urges global action appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: APT28
## Attribution & Identity
Attributed by the French foreign ministry to Russia’s military intelligence agency (GRU). Publicly linked to the Russian Federation. Known aliases include UAC-0001. The group has been linked operationally to attacks conducted by UAC-0063 (with medium confidence).
## Activity Summary
APT28 has been highly active since 2021, conducting espionage campaigns against targets in France, Europe, Ukraine, and North America. The group is actively used to exert continual pressure on Ukrainian infrastructures amid Russia’s war of aggression.
**Historical and Recent Notable Activities:**
* Involved in the 2015 cyberattack on TV5Monde.
* Attempted disruption of the 2017 French elections.
* Since 2021, compromised approximately a dozen French entities.
* In 2024, targeted French governmental, diplomatic, and research entities.
* Observed conducting espionage campaigns against NATO member states and EU countries.
* CERT-UA documented the use of an OceanMap stealer update between December 2023 and February 2024.
* In July, UAC-0063 (linked to APT28) targeted a Ukrainian scientific research institution using Hatvibe and Cherryspy malware.
## Tactics, Techniques & Procedures
- Conducting phishing campaigns (including against UKR.NET and Yahoo email users).
- Exploiting known vulnerabilities, including the zero-day CVE-2023-23397.
- Carrying out brute-force attacks, notably against webmail services.
- Compromising generally poorly-supervised edge devices to minimize detection.
- Utilizing low-cost, ready-to-use outsourced infrastructure (rented servers, free hosting, VPNs, temporary email services) for flexibility and stealth.
- In specific espionage cases, campaigns characterized by the *absence* of a dedicated mechanism for persistent access, focusing instead on direct, immediate information access.
- Establishing persistence via scheduled tasks (observed in some cases).
- Exfiltrating credentials via the IMAP protocol (using OceanMap).
**Specific Malware/Infection Chains Observed:**
* HeadLace backdoor (commands distributed via Mocky\[.\]IO service endpoints).
* OceanMap stealer (updated version used between late 2023/early 2024).
* SteelHook and MasePie malicious codes (used to deploy OceanMap updates).
* Hatvibe and Cherryspy malware (observed when operating as UAC-0063).
## Targeting
- **Sectors:** Public services, private companies, sports organizations (including one involved in the 2024 Olympic and Paralympic Games), governmental entities, diplomatic entities, research entities, and critical energy infrastructure (Ukraine).
- **Geography:** France (primary focus in recent French statements), Ukraine, European Union countries, NATO member states, and North America.
- **Victims:** A dozen French entities since 2021; Ukrainian infrastructure; various European partners.
## Tools & Infrastructure
- **Malware families used:** HeadLace, OceanMap, SteelHook, MasePie, Hatvibe, Cherryspy.
- **Infrastructure:** Mocky\[.\]IO (used for command distribution and phishing redirection), compromised routers, dynamic domain name resolution services (for concealing exfiltration servers), rented servers, free hosting services, and VPN services.
## Implications
APT28 remains a highly capable espionage threat linked directly to Russian state intelligence (GRU). Their operations are ongoing and occur directly alongside Russia's war of aggression against Ukraine, suggesting a strategic objective to collect intelligence on NATO/EU partners while simultaneously undermining Ukrainian defense and civil infrastructure. The adaptation of TTPs, while reusing core capabilities, indicates ongoing operational refinement aimed at stealth and exploiting timely vulnerabilities. The targeting of public services and Olympic-related organizations highlights an intent to sow disruption in areas critical to French national life.
## Mitigations
- Implement robust security measures against phishing, especially targeting email services (UKR.NET, Yahoo, webmail).
- Promptly patch systems against vulnerabilities known to be exploited by APT28, such as CVE-2023-23397.
- Enhance monitoring and defense strategies for edge devices.
- Review security around webmail access points (e.g., defenses against brute-force attacks).
- Be vigilant for unauthorized scheduled tasks being established on systems.
- Monitor for data exfiltration attempting to utilize protocols like IMAP or communication channels related to temporary hosting/free web services.