Sednit

Sednit, also known as APT28, Fancy Bear, Strontium/Forest Blizzard, Pawn Storm, Sofacy, and BlueDelta, is a threat actor group associated with Russia’s military intelligence. This group has been active since at least 2007, targeting governments, militaries, and security organizations worldwide. Sednit is known for its focus on targets of Russian interest, particularly those of military significance. The group has been implicated in a variety of sophisticated cyber-attacks, including the exploitation of XSS vulnerabilities in Roundcube, an open-source webmail system, and the deployment of the first UEFI rootkit found in the wild. ESET, a cybersecurity firm, has shed light on the commands used by Sednit's preferred backdoor methods. As far back as 2019, Sednit was identified using a malicious downloader written in Nim, indicating their early adoption of emerging technologies to further their objectives. In addition to these tactics, Sednit was responsible for the deployment of LoJax, the first UEFI rootkit found in the wild, which presents significant threats due to its persistence and ability to survive operating system reinstallation or hard disk replacement. In recent years, Sednit has continued to pose a significant threat. The group has been linked to a network of hundreds of Ubiquiti Edge OS routers infected with Moobot malware, controlled by GRU Military Unit 26165, another alias for Sednit. In response, authorities have taken action to disrupt Sednit's control over these devices, adding firewall rules to prevent the group from regaining control. Despite these efforts, Sednit remains a potent threat actor, demonstrating both a high level of technical sophistication and a clear strategic focus on targets of national and international significance.