Fancy Bear

Threat Actor updated 4 months ago (2024-05-04T20:50:22.391Z)

Download STIX

Preview STIX

Fancy Bear is a sophisticated Russian-based threat actor, also known as Sofacy or APT 28, that has been active since the mid-2000s. Fancy Bear is responsible for targeted intrusion campaigns against the Aerospace, Defense, Energy, Government and Media sectors. At the DNC, both Cozy Bear and Fancy Bear breached the network separately, with the latter breaching the network in April of 2016. CrowdStrike's IR team and technology were deployed to identify both adversaries on the network. While Fancy Bear does not have the same profile as other state-sponsored Russian teams such as Forest Blizzard and Seashell Blizzard, it is important to note that multiple Western governments attribute activity attributed by CERT-UA to APT 28 to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). Earlier this year, Fancy Bear threat actors were found exploiting an old SNMP bug to infect routers. In conclusion, Fancy Bear is a highly skilled threat actor that has been involved in various cyberattacks over the years. Its activities have been attributed to the GRU, and it continues to be a significant threat to organizations across several sectors. The use of advanced technology and expert incident response teams can help in identifying and mitigating the impact of Fancy Bear's attacks.

Description last updated: 2023-06-21T12:14:58.906Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
APT28	8	APT28, also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM, is a threat actor linked to Russia that has been active since at least 2007. The group has targeted governments, militaries, and security organizations worldwide, including the German Social Democratic Party
STRONTIUM	4	Strontium, also known as APT28, Fancy Bear, Forest Blizzard, and several other names, is a threat actor linked to Russia's General Staff Main Intelligence Directorate (GRU). Active since at least 2007, the group has targeted governments, militaries, and security organizations worldwide. Strontium's
Pawn Storm	3	Pawn Storm, also known as APT28, Fancy Bear, Sofacy Group, Sednit, BlueDelta, and STRONTIUM, is a threat actor that has been active since at least 2007. This group is notorious for targeting governments, militaries, and security organizations worldwide. The cybersecurity industry identifies Pawn Sto
Sednit	2	Sednit, also known as APT28, Fancy Bear, Pawn Storm, Sofacy Group, BlueDelta, and Strontium, is a threat actor associated with Russia's military intelligence. The group has been active since at least 2007, primarily targeting governments, militaries, and security organizations worldwide. Notably, Se

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

russian

Vulnerability

Apt

Malware

exploited

flaw

Ukraine

Windows

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

ID	Type	Votes	Profile Description
Sofacy	Unspecified	3	Sofacy is a threat actor group that has been observed using multiple languages to create variants of the Zebrocy Trojan and Cannon. In one campaign, they relied heavily on filenames to lure victims into launching weaponized documents. The group packed only Delphi variants in an attempt to increase e
IRON TWILIGHT	Unspecified	2	IRON TWILIGHT is a threat actor believed to be associated with the GRU, Russia's military intelligence agency. This association has been suggested by various researchers, including those from CrowdStrike and CTU, based on the characteristics of the group's activities. The group became particularly a
Cozy Bear	Unspecified	2	Cozy Bear, also known as APT29, Midnight Blizzard, and Nobelium, is a threat actor believed to operate out of Russia's Foreign Intelligence Service or SVR. This group has been linked to several high-profile cyber intrusions. One of the earliest identified activities of Cozy Bear was at the Democrati

Source Document References

Information about the Fancy Bear Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	Ukrainian email servers subjected to Russian APT cyberespionage operation
Securityaffairs	a year ago	APT28 hacked Roundcube email servers of Ukrainian entities
CERT-EU	a year ago	Cyber Security Today, June 21, 2023 – More MOVEit victims, more ransomware news and 100,000 stolen ChatGPT credentials up for sale \| IT World Canada News
CERT-EU	a year ago	Russian hackers breach Ukrainian government and military entities
Recorded Future	a year ago	BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities \| Recorded Future
CERT-EU	a year ago	Russia sent its reserve team to wipe Ukrainian hard drives
CERT-EU	a year ago	CISA bans remote management of network devices
CERT-EU	2 years ago	How Hackers Outwit All Efforts to Stop Them: "It's a Cyber Pandemic." \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker - National Cyber Security
CSO Online	a year ago	Gigabyte firmware component can be abused as a backdoor
BankInfoSecurity	a year ago	Ukraine Identifies Central Asian Cyberespionage Campaign
MITRE	2 years ago	Our Work with the DNC: Setting the record straight
MITRE	2 years ago	How they did it (and will likely try again): GRU hackers vs. US elections
MITRE	2 years ago	IRON TWILIGHT Supports Active Measures
MITRE	2 years ago	Cobalt Group 2.0
MITRE	2 years ago	Sednit Espionage Group Attacking Air‑Gapped Networks \| WeLiveSecurity
CERT-EU	2 years ago	烏克蘭
CERT-EU	2 years ago	⛑️ Le gang Russe Killnet perturbe les opérations de sauvetage de l’OTAN en Turquie. Beaucoup de bruit pour rien ?
BankInfoSecurity	a year ago	Ukraine Tracks Increased Russian Focus on Cyberespionage
CSO Online	a year ago	Two Patch Tuesday flaws you should fix right now
CERT-EU	a year ago	Cyber security week in review: March 17, 2023