APT28
No sourced public emblem in this profile.
research profile · reported nexus: RU (not nationality)
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.
Source-reported aliases: Pawn Storm, FANCY BEAR, Sednit, SNAKEMACKEREL, Tsar Team, TG-4127, STRONTIUM, Swallowtail, IRON TWILIGHT, Group 74, SIG40, Grizzly Steppe, G0007, ATK5, Fighting Ursa, ITG05, Blue Athena, TA422, T-APT-12, APT-C-20, UAC-0028, UAC-0001, FROZENLAKE, Sofacy, Forest Blizzard, BlueDelta, Fancy Bear, GruesomeLarch, LAKE RELIC. Associations do not prove equivalence.
Kinwilder analysis
Keep campaign-specific evidence alongside the group label. Shared tooling is weaker evidence than a documented chain of observations. Defensive work benefits from source-linked techniques, authentication telemetry, and a clear separation between state association and individual citizenship.
Target geography
Catalog-listed countries (associations, not attack counts): 
Georgia · 
France · 
Jordan · 
United States of America · 
Hungary · 
Armenia · 
Tajikistan · 
Japan · 
Ukraine · 
Belgium · 
Pakistan · 
Türkiye · 
Mongolia · 
United Kingdom · 
Germany · 
Poland · 
Afghanistan · 
Kazakhstan · 
China
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://attack.mitre.org/groups/G0007/
https://en.wikipedia.org/wiki/Fancy_Bear
https://en.wikipedia.org/wiki/Sofacy_Group
https://www.bbc.com/news/technology-37590375
https://www.bbc.co.uk/news/technology-45257081
https://www.cfr.org/interactive/cyber-operations/apt-28
https://www.apnews.com/4d174e45ef5843a0ba82e804f080988f
https://www.voanews.com/a/iaaf-hack-fancy-bears/3793874.html
https://securelist.com/a-slice-of-2017-sofacy-activity/83930/
https://www.dw.com/en/hackers-lurking-parliamentarians-told/a-19564630
https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/
https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
https://www2.fireeye.com/rs/848-DID-242/images/wp-mandiant-matryoshka-mining.pdf
https://www.eff.org/deeplinks/2015/08/new-spear-phishing-campaign-pretends-be-eff
https://aptnotes.malwareconfig.com/web/viewer.html?file=../APTnotes/2014/apt28.pdf