From TV5Monde to Govt: France Blames Russia’s APT28 for Cyberattacks

France’s cybersecurity agency ANSSI and the French foreign ministry attribute a series of cyber espionage attacks against a dozen French entities to the GRU-linked APT28 (Fancy Bear) group. The report details 2024 campaigns using phishing, vulnerability exploitation, brute-force access, rented/outsourced infrastructure, and the distribution of malware such as the HeadLace backdoor and OceanMap stealer, and highlights historical impersonation operations (e.g., TV5Monde) and targeting across government, defence, aerospace, research, finance and media.