20 years of Fancy Bear (APT28): How Russian military hackers evolved their tradecraft since 2004
Source Reddit Cybersecurity
Discussion
This content is a retrospective analysis of the APT28 threat actor, also known as Fancy Bear, detailing their evolution in cyber tradecraft since 2004. The report highlights APT28's unique capability linking remote cyberattacks with physical close-access operations. The information is presented as a threat intelligence overview rather than a specific vulnerability or exploit. No direct technical vulnerability or exploit details are provided in this content.
r/cybersecurity (opens in a new tab)u/R4yfield0 points0 comments
Since 2025, we have partnered with foreign and domestic law enforcement and government agencies, including the FBI, to disrupt GRU cyber operations. Today, as part of a broader public-private coordinated disclosure aimed at constraining their activities, we released a retrospective analysis of APT28's evolving arsenal (aka Fancy Bear, Sofacy, Forest Blizzard, Blue Delta, and 28 other names that we have compiled).
Our latest report traces two decades of their tradecraft shifts since 2004.
In fact, APT28 stands out as the only intrusion set with a proven link between remote cyberattacks and physical close-access operations.
If you're into threat intel or malware analysis, you can check out the arsenal evolution here: