CORESHELL

Description

Sofacy (a.k.a. APT28) is a malware family associated with Russian state sponsored actors, and its downloader tooling appears at the start of espionage campaigns against governments and militaries in Europe and North America. Its implants survey infected systems, harvest credentials, and stage further tooling for operators who favor quick, opportunistic collection. The family's long association with the group's broader operations has made it one of the most documented state sponsored toolsets.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

11 techniques across 4 tactics.

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0007 Discovery

T1082System Information Discovery
T1680Local Storage Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
- T1071.003Mail Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0007APT28

Alert name variants

Alert Name	Engine
Gen:Variant.Sofacy.5	AV
Gen:Variant.Sofacy.7	AV
MacOS.Trojan.Sofacy	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Sofacy	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Sofacy	ATP Sandbox Adv. Heuristics
Win32.Trojan.Sofacy	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Sofacy	ATP Sandbox Adv. Heuristics
Win64.Trojan.Sofacy	ATP Sandbox Adv. Heuristics

Description

Stats

MITRE ATT&CK techniques

TA0003 Persistence

TA0005 Stealth

TA0007 Discovery

TA0011 Command and Control

Associated groups

Alert name variants

Related blogs

Cloud Threats Memo: Why Multi-Factor Authentication is a Must-Have

Related families

References