Tactics, Techniques & Procedures (TTPs): Specializes in zero-day exploitation of webmail platforms (Roundcube, Outlook), credential harvesting, and long-term persistence within government networks. Known for 'Living-off-the-Land' (LotL) techniques and the use of custom implants.

APT28 remains one of the most disciplined and effective state-sponsored entities. Their recent campaign against Ukrainian anti-corruption agencies demonstrates a high degree of 'Target Intelligence.' By focusing on Roundcube, they exploit a common denominator in European public sector infrastructure. Their TTPs have evolved to include 'Zero-Click' triggers where the mere act of opening an email initiates the exploit chain. This reduces the 'Human Error' requirement for successful intrusion, making their campaigns significantly harder to defend against. The Bureau assesses that APT28 is currently prioritizing 'Information Integrity' attacks, where the goal is not just to steal data, but to gain the ability to manipulate or delete records within the Ukrainian legal system to serve Russian strategic interests.