GRU Unit 26165

Reported Context (2)

The unit to which APT28 is publicly attributed; also listed by Sekoia among names compiled for the adversary. APT28’s Tradecraft Evolves from X-Agent to LLM-Driven Malware
Described as exploiting vulnerable edge routers and using them as relay nodes. Network Telemetry Reveals Nation-State Pre-Positioning in the Defense Industrial Base

CVE (2)

Malware (16)

People (1)

Threat Actors (38)

Vendors (1)

Products (18)

Tools (4)

Industries (10)

Countries (12)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.