APT28 is one of Russia’s longest running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against U.S., countries of the former Soviet Union, Europe, and now, Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government.
Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 perform their attacks using a spoofed website and phishing emails containing links to the said websites. From there, a malware is deployed which are made up of highly obfuscated codes.
Recently, APT 28 (allegedly) has attacked Eastern European countries using Empire and Invoke-Obfuscation.
CVE-2021-40444, the MSHTML Remote Code Execution vulnerability is being used by the threat actors.