Threat Intelligence / Actor / Fighting Ursa (APT28) / Fog Ransomware

Fighting Ursa (APT28) / Fog Ransomware

Nation: Russia · 1 tracked threat(s) · Categories: VULNERABILITY

Also known as: Fighting Ursa, APT28, Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM, GRU Unit 26165, Fog Ransomware, Fog Group

Tracked threats

Unit 42 Deep Dive: Advanced AD CS Exploitation — Certificate Template Misuse (ESC1) and Shadow Credentials via msDS-KeyCredentialLink (CVE-2022-26923, Fog Ransomware, Fighting Ursa) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence