APT28 Nearest Neighbor Campaign

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.(Citation: Nearest Neighbor Volexity)

This is a historical record and does not establish current campaign activity.

Threat actor

APT28

Attribution confidence

Not established

First documented activity

2022-02-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-02-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-11-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1003.003 · NTDS

  Credential Access — During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via <code>vssadmin</code>.(Citation: Nearest Neighbor Volexity)

• T1567 · Exfiltration Over Web Service

  Exfiltration — During APT28 Nearest Neighbor Campaign, APT28 exfiltrated data over public-facing webservers – such as Google Drive.(Citation: Nearest Neighbor Volexity)

• T1059.001 · PowerShell

  Execution — During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet <code>Get-ChildItem</code> to access credentials, among other PowerShell functions deployed.(Citation: Nearest Neighbor Volexity)

• T1560.001 · Archive via Utility

  Collection — During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (<code>Compress-Archive</code> cmdlet) to compress collected data.(Citation: Nearest Neighbor Volexity)

• T1059.003 · Windows Command Shell

  Execution — During APT28 Nearest Neighbor Campaign, APT28 used <code>cmd.exe</code> for execution.(Citation: Nearest Neighbor Volexity)

• T1686.003 · Windows Host Firewall

  Defense Impairment — During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems.(Citation: Nearest Neighbor Volexity)

• T1110.003 · Password Spraying

  Credential Access — During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials.(Citation: Nearest Neighbor Volexity)

• T1016.002 · Wi-Fi Discovery

  Discovery — During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.(Citation: Nearest Neighbor Volexity)

• T1669 · Wi-Fi Networks

  Initial Access — During APT28 Nearest Neighbor Campaign, APT28 established wireless connections to secure, enterprise Wi-Fi networks belonging to a target organization for initial access into the environment.(Citation: Nearest Neighbor Volexity)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.(Citation: Nearest Neighbor Volexity)

• T1074.001 · Local Data Staging

  Collection — During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the <code>C:\ProgramData</code> directory.(Citation: Nearest Neighbor Volexity)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During APT28 Nearest Neighbor Campaign, APT28 used RDP for lateral movement.(Citation: Nearest Neighbor Volexity)

• T1003.002 · Security Account Manager

  Credential Access — During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: <code>reg save hklm\sam, reg save hklm\system,</code> and <code>reg save hklm\security</code>.(Citation: Nearest Neighbor Volexity)

• T1561.001 · Disk Content Wipe

  Impact — During APT28 Nearest Neighbor Campaign, APT28 used the native Microsoft utility cipher.exe to securely wipe files and folders – overwriting the deleted data using <code>cmd.exe /c cipher /W:C</code>.(Citation: Nearest Neighbor Volexity)

• T1584 · Compromise Infrastructure

  Resource Development — During APT28 Nearest Neighbor Campaign, APT28 compromised third-party infrastructure in physical proximity to targets of interest for follow-on activities.(Citation: Nearest Neighbor Volexity)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During APT28 Nearest Neighbor Campaign, APT28 leveraged SMB to transfer files and move laterally.(Citation: Nearest Neighbor Volexity)

• T1090.001 · Internal Proxy

  Command And Control — During APT28 Nearest Neighbor Campaign, APT28 used the built-in <code>netsh portproxy</code> command to create internal proxies on compromised systems.(Citation: Nearest Neighbor Volexity)

• T1006 · Direct Volume Access

  Stealth — During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing <code>vssadmin</code> in order to dump the NTDS.dit file.(Citation: Nearest Neighbor Volexity)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0051

  Official MITRE ATT&CK campaign record C0051. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.