# Apt28 Fancy Bear

Adversary-emulation profile for APT28 (G0007 / Fancy Bear / Forest Blizzard / Sofacy /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt28-fancy-bear -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt28-fancy-bear -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt28-fancy-bear -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt28-fancy-bear -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT28 (G0007 / Fancy Bear / Forest Blizzard / Sofacy / STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT28 (Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM), Adversary Emulation Profile

APT28 (MITRE ATT&CK **G0007**) is a long-running cyber-espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), **military unit 26165**, operating since at least 2004. Across two decades it has hit governments, militaries, diplomatic bodies, defense and aerospace, anti-doping and chemical-weapons watchdogs, media, and, since 2022, Western logistics and IT firms supporting Ukraine. APT28 is best characterized by disciplined credential operations (spearphishing, large-scale password spraying, NTLM-coercion), pragmatic use of N-day exploits (Outlook, Exchange, WinRAR, Windows Print Spooler), a broad cross-platform malware stable (Windows/Linux/macOS/Android, plus the LoJax UEFI rootkit), and a willingness to pivot from pure espionage into influence, hack-and-leak, and occasional destructive/DDoS operations. This profile maps its tradecraft to ATT&CK so Decepticon can emulate it inside an authorized engagement and the blue cell can anticipate detection.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt28-fancy-bear/SKILL.md