Cybersecurity articles tagged #APT28 on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/leaked-russian-cyber-ops-training-exposes-institutional-pathwayshttps://runtimerebel.com/blog/leaked-russian-cyber-ops-training-exposes-institutional-pathwaysLeaked materials reveal Russia's institutional system for generating cyber capabilities, linking university recruitment to GRU and Sandworm units for diverse operations.Tue, 01 Sep 2026 19:02:45 GMTGRUSandwormRussiaCyber WarfareAPT28https://runtimerebel.com/blog/apt28-s-hookedge-backdoor-targets-european-diplomacyhttps://runtimerebel.com/blog/apt28-s-hookedge-backdoor-targets-european-diplomacyRussian state-sponsored BlueDelta (APT28) leverages HOOKEDGE backdoor via macro-enabled documents to target European government and diplomatic entities.Tue, 01 Sep 2026 02:51:27 GMTSpear PhishingBlueDeltaAPT28HOOKEDGEHEADLACEhttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationshttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationsRussian threat actors exploit a Microsoft Outlook Web Access (OWA) flaw to maintain persistent mailbox access even after passwords are changed or rotated.Thu, 30 Jul 2026 10:25:52 GMTAPT28Microsoft OWACredential Rotation BypassState Sponsoredhttps://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoorhttps://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoorRussian APT28 hackers exploit an Exchange OWA zero-day to deploy the OWAReaper backdoor, gaining persistent access to high-value government mailboxes.Thu, 30 Jul 2026 02:30:39 GMTAPT28CVE-2024-43451OWAReaperMicrosoft Exchangehttps://runtimerebel.com/blog/russian-apt-exploits-zimbra-zero-day-to-exfiltrate-mail-and-2fa-codeshttps://runtimerebel.com/blog/russian-apt-exploits-zimbra-zero-day-to-exfiltrate-mail-and-2fa-codesRussian state-supported actors leveraged a Zimbra Zero-Day to steal 90 days of email history and bypass security by exfiltrating 2FA recovery codes.Thu, 23 Jul 2026 21:06:08 GMTZimbraRussian EspionageAPT28Zero-DayEmail Securityhttps://runtimerebel.com/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-thefthttps://runtimerebel.com/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-theftCISA warns of Russian APT Laundry Bear (Void Blizzard) exploiting a patched Zimbra zero-click flaw combined with phishing to compromise email servers for data…Thu, 23 Jul 2026 17:27:19 GMTLaundry BearVoid BlizzardAPT28Zimbra CollaborationZero ClickEmail TheftPhishingRussian APThttps://runtimerebel.com/blog/uk-and-eu-sanction-russian-apts-over-critical-infrastructure-attackshttps://runtimerebel.com/blog/uk-and-eu-sanction-russian-apts-over-critical-infrastructure-attacksRecent UK and EU sanctions target Russian intelligence services following persistent cyber operations against government entities and critical infrastructure.Tue, 14 Jul 2026 02:36:59 GMTAPT28APT29Russian CyberattacksCritical InfrastructureSanctionshttps://runtimerebel.com/blog/eu-sanctions-russian-intel-officers-for-apt28-cyber-operationshttps://runtimerebel.com/blog/eu-sanctions-russian-intel-officers-for-apt28-cyber-operationsThe EU imposes sanctions on Russian GRU officers linked to APT28 for long-term cyber espionage and sabotage targeting government and infrastructure.Mon, 13 Jul 2026 11:22:06 GMTAPT28GRUEU SanctionsCyber EspionageCritical Infrastructurehttps://runtimerebel.com/blog/russian-apts-target-critical-infrastructure-via-edge-device-exploitshttps://runtimerebel.com/blog/russian-apts-target-critical-infrastructure-via-edge-device-exploitsUS and allies warn of Russian state-sponsored actors targeting edge devices to infiltrate critical infrastructure. Learn how to mitigate these threats.Mon, 13 Jul 2026 11:21:02 GMTAPT28SandwormCiscoCritical InfrastructureEdge Securityhttps://runtimerebel.com/blog/cve-2023-38831-russian-apts-target-ukraine-via-winrar-flawhttps://runtimerebel.com/blog/cve-2023-38831-russian-apts-target-ukraine-via-winrar-flawRussian threat actors are exploiting the CVE-2023-38831 WinRAR vulnerability to target Ukrainian government and military entities for data theft.Tue, 09 Jun 2026 17:01:57 GMTCVE-2023-38831WinRARAPT28SandwormUkrainehttps://runtimerebel.com/blog/apt28-exploits-incomplete-windows-patch-zero-click-attacks-persisthttps://runtimerebel.com/blog/apt28-exploits-incomplete-windows-patch-zero-click-attacks-persistAn incomplete Windows patch leaves systems vulnerable to zero-click attacks. Russia-linked APT28 exploited this against Ukraine and EU. Learn how to defend.Mon, 27 Apr 2026 16:40:47 GMTWindowsZero ClickAPT28Patch BypassVulnerabilityMicrosoftCyber Warfarehttps://runtimerebel.com/blog/apt28-analysis-mitigation-strategies-against-fancy-bear-campaignshttps://runtimerebel.com/blog/apt28-analysis-mitigation-strategies-against-fancy-bear-campaignsA technical analysis of APT28's global operations, highlighting the necessity of Zero Trust and rapid patching to counter Fancy Bear threat activity.Fri, 10 Apr 2026 08:40:01 GMTAPT28Fancy BearRussiaNation StateZero Trusthttps://runtimerebel.com/blog/apt28-forest-blizzard-dns-manipulation-targets-soho-routershttps://runtimerebel.com/blog/apt28-forest-blizzard-dns-manipulation-targets-soho-routersRussian APT28, or Forest Blizzard, is conducting malwareless cyber espionage by manipulating DNS settings on vulnerable SOHO routers to steal credentials from global…Thu, 09 Apr 2026 04:53:01 GMTAPT28Forest BlizzardSOHO RoutersDNS ManipulationCredential TheftCyber EspionageNation Statehttps://runtimerebel.com/blog/apt28-targets-ukraine-and-nato-allies-with-new-prismex-malwarehttps://runtimerebel.com/blog/apt28-targets-ukraine-and-nato-allies-with-new-prismex-malwareAPT28 (Forest Blizzard) deploys the undocumented PRISMEX malware suite against Ukraine and NATO, utilizing COM hijacking and cloud-based C2 infrastructure.Wed, 08 Apr 2026 16:31:54 GMTAPT28PRISMEXForest BlizzardUkraineNATOCOM Hijackinghttps://runtimerebel.com/blog/apt28-exploits-mikrotik-tp-link-routers-in-dns-hijackinghttps://runtimerebel.com/blog/apt28-exploits-mikrotik-tp-link-routers-in-dns-hijackingRussian state-linked APT28 (Forest Blizzard) is compromising insecure SOHO routers globally, employing DNS hijacking for cyber espionage since May 2025.Tue, 07 Apr 2026 20:18:04 GMTAPT28Forest BlizzardSOHO RoutersMikroTikTP LinkDNS HijackingCyber Espionagehttps://runtimerebel.com/blog/apt28-frostarmada-dns-hijack-campaign-steals-microsoft-365-loginshttps://runtimerebel.com/blog/apt28-frostarmada-dns-hijack-campaign-steals-microsoft-365-loginsAuthorities disrupt APT28's FrostArmada campaign, which used DNS hijacking of MikroTik and TP-Link routers to steal Microsoft 365 account credentials.Tue, 07 Apr 2026 16:28:36 GMTAPT28FrostArmadaDNS HijackingMicrosoft 365MikroTikTP LinkCredential Thefthttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kithttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kitRussian APT Star Blizzard (APT28) now uses the DarkSword iOS exploit kit to target government, finance, and academia, increasing mobile threat exposure.Mon, 30 Mar 2026 12:35:23 GMTStar BlizzardAPT28Fancy BearNobeliumDarkSwordiOSExploit KitState SponsoredMobile SecuritySpear Phishinghttps://runtimerebel.com/blog/apt28-targets-ukraine-via-cve-2024-45519-zimbra-exploithttps://runtimerebel.com/blog/apt28-targets-ukraine-via-cve-2024-45519-zimbra-exploitRussian APT28 hackers exploit CVE-2024-45519 in Zimbra Collaboration Suite to target Ukrainian government entities via malicious email-based command injection.Thu, 19 Mar 2026 16:25:10 GMTAPT28ZimbraCVE-2024-45519UkraineSSSCIPGRUhttps://runtimerebel.com/blog/sednit-apt28-resurfaces-advanced-toolkit-threat-analysishttps://runtimerebel.com/blog/sednit-apt28-resurfaces-advanced-toolkit-threat-analysisRussian-affiliated APT Sednit (APT28) has returned with sophisticated new malware, shifting from simple implants. Understand their updated TTPs and mitigation strategies.Tue, 10 Mar 2026 20:14:43 GMTSednitAPT28RussiaNation StateMalwareToolkithttps://runtimerebel.com/blog/ai-enhanced-cyberattacks-microsoft-details-llm-abuse-by-apt-groupshttps://runtimerebel.com/blog/ai-enhanced-cyberattacks-microsoft-details-llm-abuse-by-apt-groupsMicrosoft reveals how nation-state actors like APT28 and Crimson Sandstorm are using AI to automate reconnaissance and refine social engineering lures.Sat, 07 Mar 2026 16:08:45 GMTAIMicrosoftAPT28LLMForest BlizzardCrimson Sandstormhttps://runtimerebel.com/blog/russian-coruna-ios-exploit-kit-targets-global-users-analysishttps://runtimerebel.com/blog/russian-coruna-ios-exploit-kit-targets-global-users-analysisSecurity researchers uncover the Coruna iOS exploit kit, a nation-state tool now used in broader campaigns to deliver spyware to mobile devices.Thu, 05 Mar 2026 04:40:41 GMTCorunaiOS SpywareAPT28Google TAGiVerifyMobile Securityhttps://runtimerebel.com/blog/apt28-exploits-cve-2026-21513-mshtml-0-day-intelligencehttps://runtimerebel.com/blog/apt28-exploits-cve-2026-21513-mshtml-0-day-intelligenceAkamai reports Russia-linked APT28 exploited CVE-2026-21513 in the MSHTML Framework as a zero-day before Microsoft's February 2026 security patch updates.Mon, 02 Mar 2026 12:17:40 GMTCVE-2026-21513APT28MSHTML FrameworkZero-DayMicrosofthttps://runtimerebel.com/blog/january-2026-cve-landscape-apt28-zero-day-critical-flawshttps://runtimerebel.com/blog/january-2026-cve-landscape-apt28-zero-day-critical-flawsRuntime Rebel details January 2026's 23 critical CVEs, including an APT28 zero-day in Microsoft Office and critical enterprise authentication bypass vulnerabilities.Wed, 25 Feb 2026 04:47:44 GMTAPT28Microsoft OfficeZero-DayAuthentication BypassEnterprise SystemsJanuary 2026CVE Landscapehttps://runtimerebel.com/blog/apt28-operation-macromaze-webhook-driven-macro-execution-targeting-western-europehttps://runtimerebel.com/blog/apt28-operation-macromaze-webhook-driven-macro-execution-targeting-western-europeAnalysis of a targeted campaign attributed to APT28, utilizing macro-enabled documents and legitimate webhook services for command-and-control obfuscation.Tue, 24 Feb 2026 04:40:50 GMTAPT28MacroMazeWebhooksRussiaEspionage