cyber.hendryadrian.com
Security Report · blog.sekoia.io

Sekoia Traces APT28’s Tradecraft Evolution From X-Agent to LLM-Driven Malware

· Original article ↗

Summary

Sekoia’s TDR team reviews APT28’s tradecraft across two decades, highlighting disposable implants, compromised edge routers, cloud-based command-and-control and LameHug, whose attribution to APT28 is assessed with medium confidence.

Key points

  • The review draws on open-source documentation and Sekoia research, and notes that it is not exhaustive because some APT28 activity may never have been publicly disclosed.
  • APT28’s toolkit shifted from signature implants such as X-Agent and X-Tunnel to short-lived, single-purpose modules, while custom implants later re-emerged in Operation Phantom Net Voxel.
  • Microsoft assessed that GooseEgg, a Windows privilege-escalation tool exploiting CVE-2022-38028, had been used since at least June 2020; it was publicly disclosed in 2024.
  • APT28 used CVE-2023-23397 in Outlook to collect Net-NTLMv2 hashes, which were relayed through compromised edge routers to target Exchange accounts.
  • The report describes operations using compromised routers for traffic proxying, phishing and DNS hijacking. Lumen observed more than 18,000 unique IPs communicating with FrostArmada infrastructure at its December 2025 peak.
  • Operation RoundPress used spear-phishing to trigger webmail XSS flaws; the SpyPress payloads could exfiltrate mailbox contents, contacts and credentials.
  • LameHug, assessed as an APT28 operation with medium confidence, queried an LLM for Windows commands and collected documents; the article describes it as a proof of concept.

Article Details

Publisher
Sekoia TDR
Report Period
2004-2026
Scope
Open-source overview of APT28 tradecraft, tooling, infrastructure, targeting, and operational changes; not an exhaustive review.
Sample Size
Not disclosed
Key Statistics
  • Sekoia compiled 33 names for the APT28 adversary.
  • At its December 2025 peak, Lumen observed more than 18,000 unique IPs across 120+ countries communicating with FrostArmada infrastructure.
  • Microsoft identified roughly 200 organizations and 5,000 consumer devices affected by FrostArmada.
  • Trend Micro reported that more than 350 datacenter VPS were still calling back to actor infrastructure after the MooBot takedown.
  • Recorded Future documented at least 42 distinct credential-harvesting chains between June 2024 and April 2025.

MITRE ATT&CK

T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolLameHug data was exfiltrated over SFTP or HTTP.T1056.001 · KeyloggingX-Agent was used for keylogging; CERT-UA also reported the Slimagent keylogger on the same operator infrastructure.T1059.001 · PowerShellSTEELHOOK is described as a PowerShell script targeting Chromium-based browser data.T1059.003 · Windows Command ShellHeadLace is described as a multi-component backdoor using CMD, VBS, and BAT components.T1059.006 · PythonAPT28 used custom Python tooling and scripts on compromised routers to scrape webmail credentials.T1071.003 · Mail ProtocolsOCEANMAP used IMAP drafts for command and control.T1102.002 · Bidirectional CommunicationAPT28 used cloud services, including Koofr, to exchange encrypted task and result files for command and control.T1187 · Forced AuthenticationCrafted Outlook reminders forced clients to authenticate to attacker-controlled SMB shares, exposing Net-NTLMv2 hashes.T1557.001 · Name Resolution Poisoning and SMB RelayThe report says captured Net-NTLMv2 hashes were relayed via compromised edge routers to obtain credentials for later reuse.T1566.001 · Spearphishing AttachmentSpear-phishing attachments delivered documents used to initiate infection, including in Operation Phantom Net Voxel.T1566.002 · Spearphishing LinkSpear-phishing links and shortened URLs led targets to credential-harvesting pages, including fake UKR.NET login pages.

CVE

CVE-2022-38028tool had been in use since at least June 2020, possibly as early as April 2019. GooseEgg weaponises CVE-2022-38028 in the Windows Print Spooler service to obtain SYSTEM-level execution. Targets named by MicrosoftCVE-2023-23397The Outlook harvest runs in parallel. APT28 weaponised the zero-click flaw CVE-2023-23397, patched by Microsoft in March 2023 after a CERT-UA report. In-the-wild exploitation ran from April to December 2022 against

Threat Actors

APT-C-20Sekoia lists APT-C-20 among the 33 names used for the APT28 adversary.APT28Sekoia attributes this intrusion set to GRU Unit 26165. The report describes its operations against government, defense, diplomatic, and critical-infrastructure targets, including credential theft, espionage, and infrastructure compromise.ATG2Sekoia lists ATG2 among the 33 names used for the APT28 adversary.ATK5Sekoia lists ATK5 among the 33 names used for the APT28 adversary.BlueAthenaSekoia lists BlueAthena among the 33 names used for the APT28 adversary.BlueDeltaSekoia lists BlueDelta among the 33 names used for the APT28 adversary.CrisisFourSekoia lists CrisisFour among the 33 names used for the APT28 adversary.Cyber BerkutThe report describes Cyber Berkut as a persona that conducted DDoS, doxing, and document leaks against Ukrainian government, NATO, and German targets; the UK Foreign and Commonwealth Office and NCSC listed it as a GRU known front.Fancy BearSekoia lists Fancy Bear among the 33 names used for the APT28 adversary.Fighting UrsaSekoia lists Fighting Ursa among the 33 names used for the APT28 adversary.FROZENLAKESekoia lists FROZENLAKE among the 33 names used for the APT28 adversary.G0007Sekoia lists G0007 among the 33 names used for the APT28 adversary.Grey-CloudSekoia lists Grey-Cloud among the 33 names used for the APT28 adversary.Grizzly SteppeSekoia lists Grizzly Steppe among the 33 names used for the APT28 adversary.Group 74Sekoia lists Group 74 among the 33 names used for the APT28 adversary.GRU Unit 26165Sekoia lists GRU Unit 26165 among the 33 names for the APT28 adversary and attributes APT28 to this unit.GruesomeLarchSekoia lists GruesomeLarch among the 33 names used for the APT28 adversary.HELLFIRESekoia lists HELLFIRE among the 33 names used for the APT28 adversary.ICE RELICThe report says APT29, attributed to Russia's SVR, was observed looking to compromise the same US Democratic Party targets as APT28.ITG05Sekoia lists ITG05 among the 33 names used for the APT28 adversary.SednitSekoia lists Sednit among the 33 names used for the APT28 adversary.SIG40Sekoia lists SIG40 among the 33 names used for the APT28 adversary.SNAKEMACKERELSekoia lists SNAKEMACKEREL among the 33 names used for the APT28 adversary.STRONTIUMSekoia lists STRONTIUM among the 33 names used for the APT28 adversary.TA422Sekoia lists TA422 among the 33 names used for the APT28 adversary.Tsar TeamSekoia lists Tsar Team among the 33 names used for the APT28 adversary.UAC-0028Sekoia lists UAC-0028 among the 33 names used for the APT28 adversary.Z-Lom TeamSekoia lists Z-Lom Team among the 33 names used for the APT28 adversary.

Malware

BeardShell"Кібератаки UAC-0001 (APT28) у відношенні державних органів із застосуванням BEARDSHELL та COVENANT"CERT-UA(2025)CredoMapCredoMap: browser credential stealer.HEADLACEHeadLace: multi-component backdoor (CMD/VBS/BAT).LAMEHUGLameHug marks the first APT28 malware delegating its logic to an LLM, querying Qwen 2.5 through the Hugging Face API.MASEPIEMASEPIE: Python downloader, abuses the Windows URI handler with WebDAV staging.MooBotRecent operations moved infrastructure to compromised edge devices, with MooBot routers and the FrostArmada DNS hijacking campaign.OCEANMAPOCEANMAP: C# backdoor, described by IBM X-Force as a more capable successor of CredoMap, uses IMAP drafts for C2.Sedrecostage. The attackers then upgraded valuable targets to the X-Agent backdoor, often pairing it with the Sedreco loader and the X-Tunnel network pivot. ESET’s 2016 paper En Route with Sednit is still the main referenceSeduploaderstayed consistent during this period. Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage. The attackers then upgraded valuable targets to the X-Agent backdoor, often pairing itSlimagentCERT-UA also reported a C++ keylogger named Slimagent on the same operator infrastructure. ESET ties Slimagent and BeardShell to direct X-Agent code lineage, with a data-collection loop nearly identical to APT28 samplesSpyPressWeaponized XSS flaws in widely-deployed webmail platforms to inject SpyPress and silently exfiltrate inboxes, contacts, and credentials from Ukrainian government and Eastern European defense suppliers.STEELHOOKSTEELHOOK: PowerShell script targeting Chromium-based browser data.X-AgentSekoia TDR looks back at how APT28's arsenal has evolved over two decades, from its signature X-Agent implants to disposable modules, edge-device infrastructure and the first LLM-driven malware.X-TunnelThe X-Agent and X-Tunnel implants defined its highest-profile breaches, including TV5Monde, the Bundestag and the 2016 US election.Zebrocy"Zebrocy Documentation"ESET(2018)

Vendors

Alibaba Groupno hardcoded attacker logic. Instead, it carries base64-encoded natural-language prompts, queries Alibaba’s Qwen 2.5-Coder-32B-Instruct model through the Hugging Face Inference API, and runs the Windows commandsFilenobserved in August 2025: the same chain was reused with a different lure and a switch to the legitimate Filen cloud service.Hugging FaceLameHug marks the first APT28 malware delegating its logic to an LLM, querying Qwen 2.5 through the Hugging Face API.icedriveOn the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2. The implant is built to swap cloud providers easily, which matches what we observed inKoofrsits on the C2 side. Instead of standard HTTP, APT28 built a custom bridge that uses the legitimate Koofr cloud service, with tasks and results travelling as encrypted files inside the operator’s Koofr account.Microsoft"GooseEgg post-compromise tool analysis"Microsoft(2024)MikroTikFrostArmada campaign on MikroTik and TP-Link routers.TP-LinkFrostArmada campaign on MikroTik and TP-Link routers.UbiquitiMooBot botnet on hundreds of Ubiquiti EdgeRouters.

Products

HordeThe payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).MDaemonThe payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).Microsoft 365 Apps for EnterpriseMicrosoft Threat Intelligence detailed the Adversary-in-the-Middle chain against Microsoft 365.Microsoft ExchangeRelaying the Net-NTLMv2 hashes captured through CVE-2023-23397 toward Microsoft Exchange, allowing mailbox takeover without any tooling on the victim’s network.Microsoft WindowsHowever, they were still active. In parallel, APT28 maintained a custom Windows privilege-escalation utility called GooseEgg. Microsoft Threat Intelligence disclosed it in 2024 and assessed that the tool had been in useOutlookOutlook zero-clickQwen2.5-Coder-32B-Instructattacker logic. Instead, it carries base64-encoded natural-language prompts, queries Alibaba’s Qwen 2.5-Coder-32B-Instruct model through the Hugging Face Inference API, and runs the Windows commands the model returns.Roundcube Webmailinfrastructure. The payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).Signal DesktopInitial access is unusual. APT28 sends weaponised Office documents through private Signal Desktop chats, probably taking advantage of the fact that the client does not apply Mark-of-the-Web protection. Lures are themedUbiquiti EdgeRoutersMooBot botnet on hundreds of Ubiquiti EdgeRouters.UKR.NETAPT28 heavily spoofed the popular Ukrainian webmail portal UKR.NET using anonymized tunneling and custom infrastructure to bypass detection.Zimbrapayload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).

Tools

Covenant"Кібератаки UAC-0001 (APT28) у відношенні державних органів із застосуванням BEARDSHELL та COVENANT"CERT-UA(2025)GooseEggAfter the 2019 Mueller report, the intrusion set went dark publicly while quietly deploying GooseEgg for about five years.Mimikatzreport. The toolkit was unchanged: X-Agent for keylogging and screenshotting, X-Tunnel for exfiltration, Mimikatz for credential theft. Of note, both APT28 and APT29 (attributed to Russia’s foreign intelligence serviceRePythonNettechnical findings through public reporting, supporting the wider community with tooling such as RePythonNet, and pursuing collaboration with law enforcement agencies to disrupt the intrusion-set’s operations.SedKitThe implant chain stayed consistent during this period. Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage. The attackers then upgraded valuable targets to the X-Agent backdoor,

Countries

BulgariaVictims include Ukrainian government bodies, defence companies in Bulgaria and Romania producing Soviet-era equipment for Ukraine, and a smaller number of government, military and academic targets in Africa, the EU andGermanyBundestag in May 2015: roughly 16 GB exfiltrated, a possible Russian retaliation toward Germany for leading EU sanctions amid Russia’s 2014 annexation of Crimea. The EU Council imposed sanctions in October 2020 on theRomaniaVictims include Ukrainian government bodies, defence companies in Bulgaria and Romania producing Soviet-era equipment for Ukraine, and a smaller number of government, military and academic targets in Africa, the EU andRussia"Russia hacked routers to steal Microsoft Office tokens"Microsoft(2026)Ukrainegovernment, defence, diplomatic and critical infrastructure entities, with a focus on NATO members and Ukraine.United StatesThe X-Agent and X-Tunnel implants defined its highest-profile breaches, including TV5Monde, the Bundestag and the 2016 US election.

Industries

Civil societyCredential harvesting against civil societyCritical infrastructureAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.DefenseAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.EducationTargets named by Microsoft span Ukrainian, Western European and North American government, NGO, education and transportation entities. The most important takeaway is the gap: five years between operational useEnergyA targeted credential harvesting campaign aimed at Ukrainian civil society, military, and energy sectors.GovernmentAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.TransportationHowever, they were still active for about five years, they silently deployed a custom privilege escalation tool against government, NGO, and transportation targets across Ukraine, Europe, and North America.

Related Articles