Full Report
A coordinated advisory from cybersecurity and intelligence agencies across North America, Europe, and Australia confirms a two-year-long cyberespionage campaign by russian GRU Unit 26165 (APT28, Forest Blizzard, Fancy Bear). The campaign targets logistics and tech providers facilitating foreign aid to Ukraine. Detect APT28 (Forrest Blizzard, Fancy Bear) Attacks Against Western Companies Since a full-scale invasion […] The post Detect APT28 Attacks: russian GRU Unit 26156 Targets Western Logistics and Technology Companies Coordinating Aid to Ukraine in a Two-Year Hacking Campaign appeared first on SOC Prime.
Analysis Summary
# Threat Actor: GRU Unit 26165
## Attribution & Identity
**Identification:** Russian GRU Unit 26165.
**Aliases & Associations:** APT28, Forest Blizzard, Fancy Bear, BlueDelta.
**Attribution Source:** Coordinated advisory from cybersecurity and intelligence agencies across North America, Europe, and Australia.
## Activity Summary
This actor has been engaged in a two-year-long cyberespionage campaign focused on entities facilitating foreign aid to Ukraine. They relentlessly target Ukraine and its allies for espionage. Recent observed activities include:
* A long-lasting campaign revealed by Germany in May 2024.
* Hacking French public and private sectors in October 2023 using previously observed vulnerabilities and TTPs from 2022–2023 operations in Ukraine.
* Sustained, evolving efforts to compromise entities tied to Western aid and supply chains.
* Attacks targeting logistics firms and expanding their attack surface into European and North American political arenas.
* Large-scale campaigns since March 2022 targeting IP cameras across Ukraine and neighboring NATO countries using RTSP DESCRIBE requests with default or brute-forced credentials to gather intelligence.
## Tactics, Techniques & Procedures
- Establishing persistence via scheduled tasks, run keys, and malicious shortcuts in startup folders.
- Using PowerShell to prepare data for exfiltration.
- Exfiltrating data using malware and built-in system tools.
- Employing legitimate protocols and local infrastructure for stealthy, delayed exfiltration to maintain long-term access.
- Clearing event logs to hide activity.
- Utilizing vulnerabilities identical to those previously exploited in Ukraine expansions.
- **Specific TTPs mentioned:** Exploiting RTSP DESCRIBE requests for camera compromise (T1190, T1078 used implicitly).
## Targeting
**Sectors:** Logistics providers, technology providers facilitating foreign aid to Ukraine, public and private sectors (France), IP camera networks.
**Geography:** Ukraine, France, European Union (E.U.) allies, North America, neighboring NATO countries.
**Victims:** Logistics and tech providers; French public and private sectors; IP camera networks in Ukraine and neighboring NATO states.
## Tools & Infrastructure
**Malware Families Used:** HEADLACE, MASEPIE, OCEANMAP, STEELHOOK.
**Infrastructure:** Not explicitly detailed, but the TTPs suggest reliance on local infrastructure and communication via legitimate protocols for exfiltration. All URLs/IPs are omitted or defanged in the source context.
## Implications
APT28 represents a sustained, high-level cyber threat stemming from the Russian state, fusing cyber espionage, influence, and attack capabilities. Their focus on supply chains and logistics supporting Ukraine demonstrates a clear linkage between kinetic conflict and cyber operations. Their expansion into North American and European political systems indicates a strategy of increasing collateral impact against NATO allies. The use of stealthy persistence and exfiltration methods allows for long-term espionage and data theft.
## Mitigations
- Implement network segmentation.
- Apply zero-trust security principles.
- Restrict lateral movement.
- Monitor logs for anomalies.
- Restrict access to hosting and API mocking platforms.
- Use only approved systems for handling sensitive information.
- Audit for unauthorized use of personal accounts in official communications.