In a separate report published today, the French National Agency for the Security of Information Systems (ANSSI) says the list of French organizations attacked by APT28 military hackers includes ministerial entities, local governments, and administrations, organizations in the French Defence Technological and Industrial Base, aerospace entities, research organizations, think-tanks, and entities in the economic and financial sector. Today, the French foreign ministry blamed the APT28 hacking group linked to Russia's military intelligence service (GRU) for targeting or breaching a dozen French entities over the last four years. "France condemns in the strongest terms the use by the Russian military intelligence service (GRU) of the APT28 attack procedure, which has led to several cyber attacks against French interests," a statement released on Tuesday says. ANSSI also highlighted several notable APT28 campaigns since 2021, including ones repeatedly targeting Roundcube e-mail servers and several others using free web services for phishing attacks. In July 2018, the United States charged multiple APT28 members for their involvement in the DNC and DCCC attacks, while the Council of the European Union also sanctioned the threat group in October 2020 for the Bundestag hack. Since the start of 2024, APT28's attacks have primarily focused on stealing "strategic intelligence" from governmental, diplomatic, research organizations, and think tanks from France, Europe, Ukraine, and North America. APT28's list of previous victims includes the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC) before the 2016 U.S. Presidential Election and the breach of the German Federal Parliament (Deutscher Bundestag) in 2015. The same week, NATO, the European Union, and international partners also formally condemned a long-term APT28 espionage campaign against multiple European countries, including Germany and the Czech Republic. Last year, Poland said that APT28's military hackers had targeted multiple Polish government institutions in a large-scale phishing campaign. Since it was first spotted more than 20 years ago, the Russian state-backed hacking group (also tracked as Strontium and Fancy Bear) was linked to GRU's Military Unit 26165 and is believed to have coordinated many high-profile cyberattacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 29 Apr 2025 19:00:09 +0000