Sednit

Sednit, also known as APT28, Fancy Bear, Pawn Storm, Sofacy Group, BlueDelta, and Strontium, is a threat actor associated with Russia's military intelligence. The group has been active since at least 2007, primarily targeting governments, militaries, and security organizations worldwide. Notably, Sednit was identified using a malicious downloader written in Nim as early as 2019. The group's activities are characterized by sophisticated techniques and the exploitation of vulnerabilities in various systems, including an old XSS vulnerability in Roundcube. ESET, a cybersecurity firm, has extensively studied the tactics and procedures of Sednit, shedding light on the commands used by their preferred backdoor. The group is also known for its use of the first UEFI rootkit found in the wild, dubbed "LoJax". This advanced level of threat activity underscores the significant capability of Sednit to compromise high-value targets and maintain persistence within their networks. In January 2024, a court-authorized operation neutralized a network of hundreds of small office/home office (SOHO) routers that GRU Military Unit 26165, another alias of Sednit, had used to conceal and enable a variety of crimes. This network of Ubiquiti Edge OS routers, infected with Moobot malware, was under the control of the threat actor. The operation added firewall rules to prevent Sednit from regaining control of the devices, demonstrating a proactive approach to countering this persistent threat.