Sofacy Group

The Sofacy Group, also known as APT28, Fancy Bear, Pawn Storm, Sednit, BlueDelta, and STRONTIUM, is a well-established threat actor that has been active since at least 2007. This group, which could be an individual, a private company, or part of a government entity, has targeted governments, militaries, and security organizations worldwide. Their activities have been marked by the use of sophisticated tools and techniques, including the creation and deployment of various Trojans and backdoors for cyber espionage purposes. Among the tools developed by the Sofacy Group is Komplex, a Trojan designed to compromise OS X devices. They have also introduced Cannon, a new Trojan with a novel email-based C2 communication channel, which had not been previously observed in their operations. The group has shown its adaptability and innovation by continuously enhancing its toolset to carry out attack campaigns across multiple platforms. In addition to these developments, the Sofacy Group has deployed a new set of data-theft modules against victims, including the AZZY backdoors with side-DLL for Command & Control (C&C). Notably, the group seems to persistently use the same hosting services to host their infrastructure, despite no direct overlap in IP addresses. As the Sofacy Group continues to bolster its toolset and refine its tactics, it remains a significant threat to global cybersecurity.