Joint Cybersecurity Advisory (CSA) AA25-141A exposes a sustained and multifaceted cyber-espionage campaign attributed to Russia’s GRU Unit 26165, also known as APT28, Fancy Bear, Forest Blizzard, and a host of other monikers. Since early 2022, this group has relentlessly targeted Western logistics and technology companies involved in supporting Ukraine, exploiting both legacy and zero-day vulnerabilities to gain access and siphon sensitive data. Their operations span credential harvesting, spearphishing, exploitation of public-facing services, and even the compromise of surveillance systems used to track aid shipments.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
This blog unpacks the key findings of the advisory and demonstrates how Logpoint’s platform equips security teams with the visibility and tools to detect, investigate, and mitigate such threats across every stage of the attack lifecycle.
By Anish Bogati and Ujwal Thapa; Security Researcher
Award winning SIEM
Go To Section
Tags
Share This Story
Copy
</div>
</div>
</div>
Introduction
Russia’s GRU Unit 26165, also known by several aliases, including APT28, is a name synonymous with cyber espionage, having cast a long shadow over the geopolitical landscape for over two decades. Its target sectors, government institutions, militaries, and security organizations, clearly reflect its motives, which are stealing sensitive information for political and military gain. In our previous coverage of APT28, also known as Forest Blizzard, we explored their long-standing espionage capabilities, custom malware arsenal, and disruptive operations across geopolitical hotspots. Our past research outlined how Logpoint empowers defenders to detect this adversary’s toolsets, especially focusing on GooseEgg, multiple credential harvesting techniques.
In this latest update, our focus shifts to GRU’s recent campaigns targeting Western logistics entities and technology companies, as detailed in the CISA Advisory. These attacks are part of a broader post-invasion escalation by GRU Unit 26165, reflecting a strategic effort to compromise supply chains supporting Ukraine. Since the onset of the Ukraine conflict, cyber operations have become a strategic extension of geopolitical aggression. These operations demonstrate a refined and persistent effort to infiltrate organizations that support Ukrainian aid and defense logistics
This blog focuses specifically on post-compromise tactics, techniques, and procedures (TTPs), rather than discussing the initial infection vectors. GRU doesn’t always rely on flashy malware; instead, they move quietly, using built-in tools like PowerShell, PsExec, or RDP to explore the network, harvest credentials, and dig deeper into high-value systems.
What makes these actions dangerous also makes them detectable: they leave behind patterns. Whether it’s suspicious mailbox permission changes, zipped data staged for exfiltration, or logs suddenly being wiped clean, these activities generate signals that defenders can pick up on, with the right visibility. Our goal here is to highlight post-compromise behaviors that are not just common but practical to detect actions that defenders can catch in the real world with good logging, smart rules, and a solid understanding of what normal looks like. For the sake of clarity, we will refer to GRU Unit 26165 as GRU in the following blog.
Detection
Required log sources:
To follow up on below threat hunting and detection approach below log sources must be configured.
- Windows
- Process creation with command-line auditing should be enabled.
- Registry Auditing
- Windows Sysmon
- To get started, you can use our sysmon baseline configuration.
- NDR
- Office365
Initial Access TTPs Discovery
Outlook NTLM vulnerability (CVE-2023-23397)
GRU’s abused an Outlook NTLM flaw: CVE-2023-23397 by sending crafted calendar invites that silently harvest NTLM hashes and user credentials. Check out our blog for a deeper dive into this technique and guidance on how to spot it in your environment.
Roundcube CVEs
Adversaries have exploited several Roundcube flaws, namely CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026, to launch arbitrary shell commands via Visual Basic scripts. To catch this behavior in your environment, use the Suspicious File Execution Using Wscript or Cscript alert, which flags any unexpected uses of these script hosts.
Exploitation of WinRAR vulnerability (CVE-2023-38831)
GRU has exploited a WinRAR vulnerability (CVE-2023-38831) to gain initial access. To spot this in your environment, look for WinRAR spawning unexpected child processes—for example:
This alert will flag any unusual script or shell hosts launched by WinRAR. For a deep dive into the CVE-2023-38831 flaw and additional detection guidance, check out our blog:
Post-Compromise TTPs Detection
Initial access techniques are countless and constantly evolving—catching every one of them as they hit is like chasing shadows. What really matters is what happens after the attacker lands. By shining a spotlight on post-compromise behaviors—privilege escalation, credential harvesting, lateral movement, data exfiltration—you’ll catch adversaries when they’re most exposed, and stop the attack before real damage is done.
Impacket and Psexec Detection
Adversaries frequently lean on built-in Windows tools and popular open-source frameworks, like Impacket and PsExec, to hop laterally through a network. PsExec’s default behavior is to drop an 8-character executable and spin it up as a service with a 4-character name. You can spot this activity with below rule
PsExec sets up a named pipe (usually prefixed with RemCom_) to shuttle commands and their output between hosts. You can spot this from Sysmon logs by looking for pipe creation events. This will catch any RemCom‐style pipes or the common stdin/stdout/stderr pipes PsExec uses.
Most Impacket tools ultimately invoke the command prompt to execute the payload. They’ll often be launched by services or admin processes. Below hunting query can be used to detect such events.
For an in-depth understanding of Impacket and its utilities, refer to our blog.
Active Directory Database Dump via NTDSUTIL
After moving laterally (often over RDP) onto a Domain Controller, GRU operators use Windows’ built-in ntdsutil.exe to extract the NTDS.dit database. CISA describes the exact steps they take:
For detection, you can leverage our built-in “Active Directory Database Dump Attempt” alert—it’s specifically tuned to catch NTDS.dit dump attempts.
Post–AD Database Dump Activities
After dumping the NTDS.dit, GRU’s operators employed two key tools, ADExplorer and Certipy, to harvest and exfiltrate directory data. They also installed Python on compromised hosts to run Certipy.
ADExplorer (a Sysinternals utility) can take “snapshots” of the AD hierarchy. You can detect its use with our alert ADExplorer Snapshot Detection.
Certipy Execution Detection
Certipy’s command set (e.g., auth, find, relay, shadow), combined with its BloodHound export flags, makes its usage distinct. Detection can be done using an alert, Certipy Tool Execution for AD CS Abuse.
Or a following hunt query can be utilized for Certipy’s activities.
Python Installation Hunting
Since Certipy runs under Python, spotting unexpected Python installs or launches can pre-empt its use. For example, detect MSI-based installs or direct Python executables:
Mailbox Folder Permission Modification and Multiple Mailbox Access
According to the Polish Cybercommand blog, the adversary modified folder permissions across mailboxes to gain unfettered access to all users’ mail. In Exchange Online, you can detect this behavior with these alerts:
Exchange Mailbox Folder Delegation Configured
Multiple Exchange Mailboxes Accessed via API in a Short Span
Defense Evasion
The GRU routinely used native Windows utilities like wevtutil to wipe event logs after gaining access or escalating privileges. This tactic helped them hide their tracks and delay detection during post-compromise activity.
Detection can be done using an alert, Suspicious Eventlog Clear or Configuration Using Wevtutil Detected.
They have also exploited the way Windows loads DLLs by planting malicious ones in directories that are searched first. This lets them execute code through trusted binaries, bypassing traditional security scans.
Detection can be done using an alert, Safe DLL Search Mode Disabled.
Persistence Techniques
GRU operators rely on tried-and-true persistence methods to maintain access, including scheduled tasks, Run-key modifications, and Startup folder payloads. Here’s how to spot each:
Schedule Tasks
You can leverage the Scheduled Task Creation Detected alert to catch every new scheduled task created in your environment.
Because the generic alert covers every new task (and can yield a high volume of results), you can instead use the Suspicious Scheduled Task Creation alert to pinpoint only those tasks originating from locations commonly abused by malware.
According to CISA’s IOC section, the threat actor created the scheduled task using an XML file so you can detect this specific technique with the Suspicious Scheduled Task Creation via Masqueraded XML File alert.
Autorun and Startup
Adding entries to the Autorun registry keys or dropping payloads into the Startup folder is a widely abused persistence method—used by both legitimate software and malware—to launch programs at Windows startup. You can catch any of these changes with the Autorun Keys Modification Detected alert, which monitors registry writes and file events against the key Run locations and Startup directories.
Impact
The GRU employs impact-focused techniques not to destroy systems outright, but rather to erase evidence, disrupt recovery, and maintain stealth during and after their operations. They utilize legitimate Windows utilities such as wevtutil.exe to clear event logs and vssadmin.exe to manipulate volume shadow copies, indicating preparations to disable backup and forensic recovery.
Detects use of system tools like vssadmin, wbadmin, or PowerShell to create or manipulate shadow copies, potentially for staging data or disabling recovery.
Hunting Malware Families
In this campaign, the GRU employed various malware families to perform essential post-compromise functions, such as persistence, credential theft, and data exfiltration. Notable among these were HEADLACE, a multi-stage backdoor recognized for its use of headless browser automation and discreet script execution, and MASEPIE, an exfiltration tool that has been previously observed in GRU operations aimed at Ukrainian interests.
HEADLACE Execution Traces hunting query
Detects use of legitimate utilities with command-line patterns often associated with malicious activity, such as data staging, headless browser automation, or scheduled task creation
HEADLACE Batch Script Artifact Hunting query
Detects command-line patterns and batch scripting behavior used in GRU's HEADLACE malware, including headless browser abuse, system recon, and deletion of local artifacts
Detection via Logpoint Muninn
Logpoint’s Network Detection and Response (NDR) Muninn can play a vital role in detecting and responding to post-compromise behaviors commonly employed by the GRU. While many of the group’s techniques rely on built-in system tools and credential abuse, they also generate distinct network patterns that can be detected in real-time with the right behavioral analytics.
Some of the notifications listed below can be useful in detecting their presence in the network :
- RDP brute force external to internal
- Lateral movement and execution
- Lateral movement using SMB admin shares
- DarkNet or Tor activity detected
- Credential dumping using RPC
- Exfiltration of many files
- Event log clearing or forced reboot using RPC
- Large Transfer Sent
Mitigations & Recommendations
Recommendations:
Train for Social-Engineering Resilience
- Regular phishing simulations: Run realistic email and messaging drills that include phishing, smishing, and pretexting scenarios.
- Prompt reporting: Establish a clear, easy-to-use process for employees to report suspected phishing or social-engineering attempts.
- Reinforce learnings: Provide targeted follow-up training for users who fall for simulations, turning mistakes into teachable moments.
Keep Software Updated
- Apply vendor updates promptly: Ensure operating systems, browsers, mail clients, and third-party applications install the latest security patches as soon as they’re available.
- Use vendor mitigations: If a patch isn’t immediately available, implement any temporary workarounds or configuration changes recommended by the vendor.
- Prioritize by severity: When multiple vulnerabilities exist, triage and remediate critical or actively exploited flaws first.
Enforce Least-Privilege Access
- Restrict permissions: Grant each user—and every service account—only the rights they need to do their job.
- Segment elevated roles: Separate administrative logins from everyday user environments to limit credential exposure.
- Review regularly: Audit access rights quarterly (or after organizational changes) and remove any stale or excessive privileges.
Require Strong Authentication
- Multi-Factor Authentication (MFA): Require MFA for all accounts—especially remote, administrative, and cloud-based logins—to ensure that stolen passwords alone aren’t enough to gain access.
- Robust Password Policies: Enforce minimum length and complexity, prevent password reuse, and lock accounts after repeated failed logins. These controls help thwart brute-force and credential-stuffing attacks.
Segment Your Network
- Micro-segmentation: Divide your network into logical zones (e.g., user workstations, servers, domain controllers) and enforce strict traffic controls between them.
- Protect critical assets: Place high-value systems—like DCs, mail servers, and backup repositories—behind additional firewalls or jump-hosts.
Privileged Access Management
- Day-to-Day Least Privilege: Have every administrator operate under a standard user account for routine tasks—only switch to a dedicated admin account when performing elevated activities. This separation helps contain malware or phishing impacts on high-privilege credentials.
- Admin Isolation: Prevent admin accounts from signing into non-privileged workstations. Restrict their login to hardened, monitored jump hosts or dedicated admin workstations to reduce the chance of credential theft or lateral movement.
Centralized Auditing and Logging
- Comprehensive Log Collection: Define and enforce logging policies across every layer—Windows Event Logs, application and database logs, cloud service and API logs, and network telemetry. Forward all of this data into your SIEM to ensure full visibility and streamline real-time analysis.
- Retention Policy: Implement a minimum six-month retention window (or longer to meet regulatory or business requirements). This guarantees that historical logs remain available for thorough incident investigations and forensic analysis.
Deploy EDR and NDR Solutions
- Endpoint Detection and Response (EDR):
Deploy endpoint agents that continuously monitor host activity, automatically detect and block malicious behavior, shrink the attack surface, and feed detailed telemetry into your security platform for faster investigations. - Network Detection and Response (NDR):
Collect and analyze network telemetry (packet captures, flow records, DNS and HTTP logs) to spot lateral movement, command-and-control traffic, or data exfiltration that EDR might miss. NDR provides a complementary view, ensuring you catch adversaries even if an endpoint agent is disabled.
Exercise Incident-Response Readiness
- Tabletop and live drills: Regularly test your playbooks against simulated intrusion scenarios to identify gaps in detection, escalation, and containment.
- After-action reviews: Document lessons learned and update procedures to strengthen your next response.
Maintain Robust Backups
- 3-2-1 rule: Keep three copies of critical data, stored on two different media types, with one copy offline or offsite.
- Automated verification: Regularly test backup restores to ensure data integrity and availability during an incident.
The post Frontline Intel: Pinpointing GRU’s TTPs in the Recent Campaign appeared first on Logpoint.
Article Link: Frontline Intel: Pinpointing GRU’s TTPs in the Recent Campaign