APT28

APT28, also known as Tsar Team, is a threat group suspected of being attributed to the Russian government. The group has targeted sectors such as the Caucasus, particularly Georgia, eastern European countries, militaries, NATO, and other European security organizations. APT28 is associated with malware like CHOPSTICK and SOURFACE, and has used techniques including RSA encryption and custom tools. The group has been linked to cyber operations against political and institutional targets, including the 2016 U.S. election interference.