All Posts
Cyber Threat Intelligence
Malware
Research
ThreatStream
1
min read

A Timeline of APT28 Activity

Published on
February 22, 2018
Table of Contents
<p><strong>APT28</strong> (aka Fancy Bear, aka Pawn Storm, aka Sednit, aka Sofacy, aka Group 74, aka Sednit, aka Sofacy, aka Strontium, aka Threat Group-4127) finds its way into the news with some regularity. Most recently the group claimed to have released documents from the International Luge Federation. APT28 is probably best known for its attacks on the Democratic National Committee (DNC) and other political targets in 2016. The group has a reputation for being organized and stealthy in their campaigns. Their choice of targets often aligns with Russian geopolitical interests.</p><p>Below is an image that summarizes publicly known APT28 activity from 2014 to present:</p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/ietdH7dbRVSf05YW6MLD"/></p><p style="text-align: center;"><em>Summary of APT28 Malicious Activity</em></p><p>Activities from APT28 have been covered by a number of information security research teams since first being reported on by Trend Micro in 2014. This corpus of information on the group is spread amongst a number of sources. The Anomali Labs team has compiled a timeline of all publicly known APT28 activities and shared it in this informative <a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank">post in the </a><a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank">Anomali</a><a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019" target="_blank"> Forum</a>.</p>

FEATURED RESOURCES

September 23, 2026
No items found.

When Criminals Hack Criminals: ShinyHunters' Breach of Clop and What It Reveals About the Ransomware Underground

Read More
September 22, 2026
Anomali Cyber Watch

NightEagle GhostContainer Backdoor, SparroWocky Against Government, RatHat Malware Uses AI to Target Banking, Jade Sleet Targets Indian IT, BragJack Hijacks AI Agents, OpenAI Identity Design Flaw, and more

NightEagle APT Expands from Asia to Russia Using GhostContainer Backdoor and Tunneling Tools. FamousSparrow Deploys SparroWocky Backdoor Against Latin American Government Agencies. RatHat Android Malware Uses AI Automation to Target Banking Credentials. Jade Sleet Targets Indian IT Provider With FLATROOF and ROOFDECK Backdoors. BragJack Proof-of-Concept Hijacks AI Browser Agents via Malicious Extensions. Researchers Chain libheif Over-Read and OpenAI Identity Design Flaw to Reach Internal Code Repository.
Read More
September 16, 2026
No items found.

Ransomware's New Hire: Why Criminal Groups Are Recruiting Your Employees Instead of Hacking Them

Read More
Explore All