DOJ GRU Indictment Jul 2018

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

CHOPSTICK is capable of performing keylogging.

APT28 has used tools to perform keylogging.

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.

CHOPSTICK has the capability to capture screenshots.

APT28 has used tools to take screenshots from victims.

APT28 has collected emails from victim Microsoft Exchange servers.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.