Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

APT28 (Fancy Bear), a Russian GRU-linked threat actor, conducted widespread NTLMv2 hash relays, credential-harvesting phishing, and exploitation of high-severity vulnerabilities (notably CVE-2023-23397) from April 2022 to Nov 2023 against government and critical-sector organizations worldwide, employing anonymization (VPN/Tor, data-center IPs, compromised EdgeOS routers), bespoke malware (HeadLace, OCEANMAP, MASEPIE, STEELHOOK), and mailbox persistence to enable lateral movement and large-scale compromise.