APT28’s Tradecraft Evolves from X-Agent to LLM-Driven Malware
Summary
Sekoia traces two decades of APT28 operations, detailing its shift to disposable implants and compromised routers, the return of custom backdoors, and LameHug, an infostealer that uses an LLM to generate commands.
Key points
- APT28, attributed to Russia’s GRU Unit 26165, has targeted government, defense, and critical infrastructure for more than two decades.
- Its early signature toolkit included X-Agent and X-Tunnel, used in high-profile espionage, data theft, and disruption operations.
- After public reporting waned following the 2019 Mueller Report, APT28 continued operating; Microsoft later disclosed GooseEgg, a privilege-escalation tool used since at least 2020.
- From 2022, APT28 increasingly used short-lived, single-purpose malware modules and exploited CVE-2023-23397 in Outlook to collect Net-NTLMv2 hashes.
- The group shifted infrastructure onto compromised routers, using them for credential collection, traffic relaying, phishing, and DNS hijacking.
- Recent operations combine disposable tools with custom implants, including Covenant, BeardShell, and Slimagent, with command-and-control traffic routed through legitimate cloud services.
- LameHug, described as a proof of concept, queries an LLM for Windows commands and was used in spear-phishing targeting Ukrainian government and defense entities.
Article Details
- Publisher
- Sekoia TDR
- Report Period
- 2004–2026
- Scope
- Open-source review of significant changes in APT28's tradecraft, tooling, infrastructure, and operational tempo; not exhaustive.
- Key Statistics
- At its peak in December 2025, Lumen observed more than 18,000 unique IPs communicating with FrostArmada infrastructure.
- The FrostArmada IPs were observed across more than 120 countries.
- Microsoft identified roughly 200 affected organisations and 5,000 affected consumer devices in the FrostArmada campaign.
- Recorded Future reported at least 42 distinct credential-harvesting chains between June 2024 and April 2025.
- Trend Micro reported that more than 350 datacenter VPS were still calling back to actor infrastructure after the MooBot takedown.
CVE
CVE-2022-38028tool had been in use since at least June 2020, possibly as early as April 2019. GooseEgg weaponises CVE-2022-38028 in the Windows Print Spooler service to obtain SYSTEM-level execution. Targets named by MicrosoftCVE-2023-23397The Outlook harvest runs in parallel. APT28 weaponised the zero-click flaw CVE-2023-23397, patched by Microsoft in March 2023 after a CERT-UA report. In-the-wild exploitation ran from April to December 2022 against
People
Threat Actors
APT-C-20Listed by Sekoia among names compiled for APT28.APT28Intrusion set discussed in the report; publicly attributed to GRU Unit 26165.APT29Separately named adversary, attributed in the article to Russia's foreign intelligence service SVR; observed seeking to compromise the same target as APT28.ATG2Listed by Sekoia among names compiled for APT28.ATK5Listed by Sekoia among names compiled for APT28.BlueAthenaListed by Sekoia among names compiled for APT28.BlueDeltaListed by Sekoia among names compiled for APT28.CrisisFourListed by Sekoia among names compiled for APT28.Cyber BerkutPersona used from March 2014 for DDoS, doxing, and document leaks against Ukrainian government, NATO, and German targets; the UK Foreign and Commonwealth Office and NCSC listed it as a GRU known front.Fancy BearListed by Sekoia among names compiled for APT28.Fighting UrsaListed by Sekoia among names compiled for APT28.Forest BlizzardListed by Sekoia among names compiled for APT28.G0007Listed by Sekoia among names compiled for APT28.Grey-CloudListed by Sekoia among names compiled for APT28.Grizzly SteppeListed by Sekoia among names compiled for APT28.Group 74Listed by Sekoia among names compiled for APT28.GRU Unit 26165The unit to which APT28 is publicly attributed; also listed by Sekoia among names compiled for the adversary.GruesomeLarchListed by Sekoia among names compiled for APT28.HELLFIREListed by Sekoia among names compiled for APT28.IRON TWILIGHTListed by Sekoia among names compiled for APT28.ITG05Listed by Sekoia among names compiled for APT28.Pawn StormListed by Sekoia among names compiled for APT28.SednitListed by Sekoia among names compiled for APT28.SIG40Listed by Sekoia among names compiled for APT28.SNAKEMACKERELListed by Sekoia among names compiled for APT28.SofacyListed by Sekoia among names compiled for APT28.STRONTIUMListed by Sekoia among names compiled for APT28.SwallowtailListed by Sekoia among names compiled for APT28.TA422Listed by Sekoia among names compiled for APT28.TG-4127Listed by Sekoia among names compiled for APT28.Tsar TeamListed by Sekoia among names compiled for APT28.UAC-0001Listed by Sekoia among names compiled for APT28.UAC-0028Listed by Sekoia among names compiled for APT28.UAC-0063Tracked cluster linked in the report to older Zebrocy operations; the associated activity is attributed to APT28 with medium confidence.Z-Lom TeamListed by Sekoia among names compiled for APT28.
Malware
BeardShellBeardShellCredoMapCredoMapGooseEggAfter the 2019 Mueller report, the intrusion set went dark publicly while quietly deploying GooseEgg for about five years.HEADLACEHeadLaceLAMEHUGLameHug marks the first APT28 malware delegating its logic to an LLM, querying Qwen 2.5 through the Hugging Face API.MASEPIEMASEPIEMooBotRecent operations moved infrastructure to compromised edge devices, with MooBot routers and the FrostArmada DNS hijacking campaign.OCEANMAPOceanMapSedrecostage. The attackers then upgraded valuable targets to the X-Agent backdoor, often pairing it with the Sedreco loader and the X-Tunnel network pivot. ESET’s 2016 paper En Route with Sednit is still the main referenceSeduploaderstayed consistent during this period. Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage. The attackers then upgraded valuable targets to the X-Agent backdoor, often pairing itSlimagentSlimagentSpyPressSpyPressSTEELHOOKSTEELHOOKX-AgentSekoia TDR looks back at how APT28's arsenal has evolved over two decades, from its signature X-Agent implants to disposable modules, edge-device infrastructure and the first LLM-driven malware.X-TunnelThe X-Agent and X-Tunnel implants defined its highest-profile breaches, including TV5Monde, the Bundestag and the 2016 US election.ZebrocyZebrocy
Vendors
Products
Filenobserved in August 2025: the same chain was reused with a different lure and a switch to the legitimate Filen cloud service.HordeThe payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).Hugging Face Inference APInatural-language prompts, queries Alibaba’s Qwen 2.5-Coder-32B-Instruct model through the Hugging Face Inference API, and runs the Windows commands the model returns. Output is collected from Documents, DesktopicedriveOn the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2. The implant is built to swap cloud providers easily, which matches what we observed inKoofrsits on the C2 side. Instead of standard HTTP, APT28 built a custom bridge that uses the legitimate Koofr cloud service, with tasks and results travelling as encrypted files inside the operator’s Koofr account.MDaemonThe payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).Microsoft 365Microsoft Threat Intelligence detailed the Adversary-in-the-Middle chain against Microsoft 365.Microsoft Exchange ServerWeaponized zero-click Outlook flaw to silently leak Net-NTLMv2 hashes from NATO ministries, defense, and critical-infrastructure targets, relaying them via compromised EdgeRouters to hijack Exchange mailboxes.Microsoft WindowsHowever, they were still active. In parallel, APT28 maintained a custom Windows privilege-escalation utility called GooseEgg. Microsoft Threat Intelligence disclosed it in 2024 and assessed that the tool had been in useMikroTikFrostArmada campaign on MikroTik and TP-Link routers.OutlookOutlook zero-clickQwen 2.5-Coder-32B-Instructattacker logic. Instead, it carries base64-encoded natural-language prompts, queries Alibaba’s Qwen 2.5-Coder-32B-Instruct model through the Hugging Face Inference API, and runs the Windows commands the model returns.Roundcubeinfrastructure. The payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).Signal DesktopInitial access is unusual. APT28 sends weaponised Office documents through private Signal Desktop chats, probably taking advantage of the fact that the client does not apply Mark-of-the-Web protection. Lures are themedTP-LinkFrostArmada campaign on MikroTik and TP-Link routers.Ubiquiti EdgeRoutersMooBot botnet on hundreds of Ubiquiti EdgeRouters.UKR.NETAPT28 heavily spoofed the popular Ukrainian webmail portal UKR.NET using anonymized tunneling and custom infrastructure to bypass detection.Zimbrapayload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).
Tools
CovenantCovenantMimikatzreport. The toolkit was unchanged: X-Agent for keylogging and screenshotting, X-Tunnel for exfiltration, Mimikatz for credential theft. Of note, both APT28 and APT29 (attributed to Russia’s foreign intelligence serviceRePythonNettechnical findings through public reporting, supporting the wider community with tooling such as RePythonNet, and pursuing collaboration with law enforcement agencies to disrupt the intrusion-set’s operations.SedKitThe implant chain stayed consistent during this period. Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage. The attackers then upgraded valuable targets to the X-Agent backdoor,
Countries
BulgariaVictims include Ukrainian government bodies, defence companies in Bulgaria and Romania producing Soviet-era equipment for Ukraine, and a smaller number of government, military and academic targets in Africa, the EU andFranceGermanyBundestag in May 2015: roughly 16 GB exfiltrated, a possible Russian retaliation toward Germany for leading EU sanctions amid Russia’s 2014 annexation of Crimea. The EU Council imposed sanctions in October 2020 on thePolandRomaniaVictims include Ukrainian government bodies, defence companies in Bulgaria and Romania producing Soviet-era equipment for Ukraine, and a smaller number of government, military and academic targets in Africa, the EU andRussia"Russia hacked routers to steal Microsoft Office tokens"Microsoft(2026)Ukrainegovernment, defence, diplomatic and critical infrastructure entities, with a focus on NATO members and Ukraine.United Kingdom"GRU Known Fronts Disclosure"UK NCSC(2018)United StatesThe X-Agent and X-Tunnel implants defined its highest-profile breaches, including TV5Monde, the Bundestag and the 2016 US election.
Industries
Critical infrastructureAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.DefenseAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.Diplomaticactors we monitor. Its operations span in two decades and consistently target government, defence, diplomatic and critical infrastructure entities, with a focus on NATO members and Ukraine.EducationTargets named by Microsoft span Ukrainian, Western European and North American government, NGO, education and transportation entities. The most important takeaway is the gap: five years between operational useEnergyA targeted credential harvesting campaign aimed at Ukrainian civil society, military, and energy sectors.GovernmentAPT28, attributed to GRU Unit 26165, has targeted government, defense and critical infrastructure entities for over two decades.IT and hosting200 organisations and 5,000 consumer devices affected, primarily foreign ministries, law enforcement, IT and hosting providers.TransportationHowever, they were still active for about five years, they silently deployed a custom privilege escalation tool against government, NGO, and transportation targets across Ukraine, Europe, and North America.