What other aliases and vendor names is APT28 known by?

APT28 is tracked across the cybersecurity industry by multiple aliases, including: 85th Main Special Service Center, APT-C-20, ATG2, ATK5, Blue Athena, BlueDelta, CrisisFour, FANCY BEAR.

What vulnerabilities and CVEs does APT28 actively exploit?

APT28 has been observed weaponizing vulnerabilities including CVE-2020-0601, CVE-2021-34527, CVE-2023-23397, CVE-2023-38831.

APT28

Q: What are the primary motivations and sponsors of APT28?

APT28 operates from Russia with primary motivation categorized as Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making, sponsored or affiliated with Russian Federation (GRU).

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia

Primary Aliases: FANCY BEAR Forest Blizzard STRONTIUM 85th Main Special Service Center

Sponsor / State Affiliation Russian Federation (GRU)

Primary Motivation Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Outlook CVE-2023-23397 Exploitation, German Political Espionage (SPD Targeting), Central and Eastern European Govt Targeting

⚔️ Weaponized CVE Matrix (4)

CVE-2020-0601

CurveBall CryptoSpoof

CVSS 8.1 KEV EPSS 78.2%

CVE-2021-34527

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

CVE-2023-23397

Outlook NTLM Relay

CVSS 9.8 KEV EPSS 92.0%

CVE-2023-38831

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Government agencies Ministry of Foreign Affairs Military and Defense organizations NATO member states European Union institutions Political parties Energy and Critical Infrastructure Think tanks and NGOs