APT28 (Fancy Bear / Forest Blizzard)

APT28 is a Russian military intelligence cyber espionage and information warfare unit operating under the GRU (Glavnoye Razvedyvatelnoye Upravleniye), specifically Unit 26165 of the 85th Main Special Service Center (GTsSS).

Threat IntelligenceTIDThreatIntermediateCONFIDENTIAL1,911 words8 min readApr 7, 2026

Last updated Apr 11, 2026

CLASSIFICATION: CONFIDENTIAL

This article requires CONFIDENTIAL clearance or higher.

What you need

Create a free Nexus ID to access CDA proprietary content including PDM domain explainers, methodology deep-dives, and reconnaissance mission briefings.

Create Nexus ID (Free)

Also at this clearance level

Threat IntelligenceTIDThreatIntermediate

Table of Contents

APT28 (Fancy Bear / Forest Blizzard)

What you need

Also at this clearance level

Lazarus Group (HIDDEN COBRA / Diamond Sleet)

Salt Typhoon

Single Sign-On (SSO) Architecture

FIDO2 and WebAuthn: Passwordless Authentication

The Academy

The Command Post

The Armory