APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS? SPECIAL REPORT SECURITY REIMAGINED 2 fireeye.com APT 28: A Window into Russia’s Cyber Espionage Operations? EXECUTIVE SUMMARY ................................................................................................................................................................................................................................................................................... 3 APT28 TARGETING REFLECTS RUSSIAN INTERESTS ........................................................................................................................................................................ 6 APT28 interest in the Caucasus, Particularly Georgia ........................................................................................................................................................... 7 APT28 Targeting of the Georgian Ministry of Internal Affairs (MIA) ....................................................................................... 8 APT28 Targeting of the Georgian Ministry of Defense ....................................................................................................................................... 9 APT28 Targeting a Journalist Covering the Caucasus ...................................................................................................................................... 10 APT28’s Other Targets in the Caucasus ....................................................................................................................................................................................... 11 APT28 Targeting of Eastern European Governments and Militaries ................................................................................................... 12 APT28 Targeting of NATO and Other European Security Organizations .................................................................................... 14 APT28 Targets European Defense Exhibitions ............................................................................................................................................................... 16 Other APT28 Targets Are Consistent With Nation State Interests ........................................................................................................ 17 APT28 MALWARE INDICATES SKILLED RUSSIAN DEVELOPERS ........................................................................................................................ 19 Modular Implants Indicate a Formal Development Environment............................................................................................................... 24 APT28 Malware Indicates Russian Speakers in a Russian Time Zone .............