Cyber Threat Actor: APT28

APT28, also known by the alias Fancy Bear, is a threat actor that has been publicly linked to Russia’s GRU military intelligence unit and is known to operate from within the Russian Federation. The group is routinely referenced in open‑source reporting under its two primary names and is described as a state‑sponsored entity engaged in intelligence‑gathering activities. Its public profile emphasizes a focus on collecting information from political and governmental targets rather than pursuing financially motivated cybercrime.

The actor’s known targeting has centered on political campaigns and associated officials, with observed activity in both France and the United States. In the spring of 2017, APT28 directed efforts toward individuals connected to Emmanuel Macron’s presidential campaign in France, seeking to gather personal data through deceptive means. The group’s strategic objective, as evidenced by these operations, appears to be espionage, aiming to acquire sensitive information that could inform state‑level decision‑making. There is no public indication that the group’s activities are driven by financial gain or destructive disruption.

Regarding tactics, techniques, and procedures, the only methods explicitly referenced in the available sources involve the creation of false social‑media personas and the use of tooling associated with the GRU. APT28 fabricated numerous Facebook accounts that posed as friends of friends to approach campaign officials and associates, attempting to collect personal information without delivering malware or stealing credentials. After the social‑media effort, the actor was linked to the compromise and online release of the Macron campaign’s email archives during the election’s final stage. Additionally, Facebook reported suspending tens of thousands of inauthentic accounts that were spreading election‑related propaganda and misinformation in France, indicating the group’s use of inauthentic amplification as part of its operational repertoire.

Significant campaigns attributed to APT28 include the 2017 Facebook‑based surveillance operation targeting the Macron campaign, the subsequent email leak that occurred later in the same election cycle, and earlier publicly reported activity directed at U.S. political entities. These examples illustrate a pattern of focusing on democratic political processes across multiple Western nations, employing social‑media deception and information‑leak tactics to achieve espionage‑oriented goals. The combination of deceptive online identities, GRU‑linked tooling, and propaganda distribution underscores the actor’s consistent emphasis on gathering and disseminating political intelligence.