Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
APT28 is a Russian state-linked espionage group associated by multiple governments with the Main Intelligence Directorate of the Russian General Staff, the GRU. Reporting commonly connects the group with operations against governments, defence organisations, media, political bodies and organisations involved in European security. Its recurring methods include spearphishing, credential theft, malware delivery and the exploitation of exposed services.
The cluster has been tracked since the mid-2000s under names including Fancy Bear, Sofacy, STRONTIUM and Forest Blizzard. Different research teams draw the group boundary slightly differently, so aliases are useful signposts rather than perfect synonyms. Its long operating history shows a willingness to reuse dependable techniques while changing infrastructure, malware and delivery methods.
Known aliases
APT28Fancy BearForest BlizzardSofacySTRONTIUM
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
