T1566.002
Initial Access
Spearphishing Link
Targeted links may lead to credential collection pages. Defenders should monitor suspicious domains, sender anomalies, and identity risk signals.
Loading ThreatScope content
APT28 / Fancy Bear is modeled as an espionage-focused actor associated with political, defense, media, and government targeting. Content is kept defensive and educational.
Motivation and analyst context
APT28 / Fancy Bear is modeled as an espionage-focused actor associated with political, defense, media, and government targeting. Content is kept defensive and educational.
Sectors and regions in this local profile
Mapped behavior for defensive monitoring
Targeted links may lead to credential collection pages. Defenders should monitor suspicious domains, sender anomalies, and identity risk signals.
Credential harvesting and password spraying are represented as identity telemetry patterns for SOC triage.
Public-facing application alerts should be triaged through patch posture, web logs, and unusual authentication activity.
Directory and mailbox enumeration can be detected through cloud audit logs and unusual query volume.
Families and tooling names for defensive awareness
Included as a defensive malware family label tied to collection and remote access monitoring.
Used as a high-level family name for endpoint detection and reporting context.
Represents tooling tracked in defensive reporting for this actor profile.
Safe, defanged, or documentation-range indicators
| Type | Value | Confidence | Note | Action |
|---|---|---|---|---|
Domain | secure-mail-gateway[.]example | High | Defanged example domain for credential-harvesting themed reporting. | |
IP | 192.0.2.17 | Medium | Documentation-range IP address for mock infrastructure. | |
SHA256 | 71b4c7f601d2b64ea3f902ec9188b126946eb9db8d32ae475947801ed1257b9f | Medium | Mock file hash for portfolio table display. |
Recent campaign activity from local mock data
Mock activity cluster involving credential harvesting signals, mailbox access anomalies, and document repository enumeration.
Analyst note covering repeated authentication failures against journalist and media staff accounts.
Safe SOC analyst guidance for monitoring and triage