France vs. Russia: Unmasking APT28’s Cyber Espionage Campaign

Breached Company

04 May 2025 — 9 min read

Introduction

On April 29, 2025, France’s Ministry for Europe and Foreign Affairs publicly accused Russia’s military intelligence agency, the GRU, of orchestrating a series of cyberattacks through its hacking unit, APT28, also known as Fancy Bear, BlueDelta, or Forest Blizzard. Since 2021, APT28 has targeted French ministries, defense contractors, think tanks, and other critical entities in a calculated effort to destabilize the country and gather strategic intelligence. France’s National Agency for the Security of Information Systems (ANSSI) detailed the group’s sophisticated tactics, which include phishing, zero-day exploits, and brute-force attacks, aimed at entities across Europe and North America. This article explores the scope of APT28’s campaign, its historical context, the tactics employed, the geopolitical implications, and France’s response to this persistent cyber threat.

The Accusations: A Decade of Cyber Aggression

France’s Public Attribution

France’s decision to publicly attribute the cyberattacks to Russia’s GRU marks a significant escalation in its response to state-sponsored cyber threats. The French Foreign Ministry condemned APT28’s actions as “unacceptable and unworthy of a permanent member of the United Nations Security Council,” arguing that they violate UN norms for responsible state behavior in cyberspace. The ministry identified at least 12 French entities targeted since 2021, including government ministries, local administrations, defense and aerospace firms, think tanks, financial and economic organizations, and a sports body linked to the 2024 Paris Olympics.

ANSSI’s report, published concurrently on April 29, 2025, revealed that APT28’s attacks surged in 2024, with approximately 4,000 cyberattacks attributed to Russian actors—a 15% increase from 2023. The agency noted that the group’s most recent attack occurred in December 2024, underscoring the ongoing threat. The public attribution, a rare move for France, was driven by the need to inform citizens amid domestic political uncertainty and Russia’s ongoing war in Ukraine, reflecting heightened geopolitical tensions.

Historical Context

APT28’s activities in France date back to at least 2015, when the group was linked to a cyberattack that disrupted the French television channel TV5Monde, initially claimed by Islamic State militants but later attributed to Russian operatives. In 2017, APT28 targeted Emmanuel Macron’s presidential campaign, leaking thousands of emails mixed with disinformation just 24 hours before the election. While the attack aimed to sow doubt and influence voters, it failed to significantly impact Macron’s victory over Marine Le Pen. These incidents highlight APT28’s long-standing focus on France as a target for cyber espionage and political interference.

APT28: Russia’s Cyber Spearhead

Profile and Affiliations

APT28, active since at least 2004, is a state-sponsored hacking group linked to GRU’s Unit 26165, based in Rostov-on-Don, Russia. Also known as Fancy Bear, Strontium, Sednit, and Sofacy, the group is notorious for its role in high-profile cyberattacks, including the 2016 U.S. Democratic National Committee (DNC) hack, which aimed to influence the U.S. presidential election. Cybersecurity firms like CrowdStrike, FireEye, and Mandiant have confirmed APT28’s ties to the Russian government, with a 2018 U.S. Special Counsel indictment formally identifying it as a GRU unit.

The group’s operations align with Russia’s geopolitical objectives, including undermining NATO, destabilizing Western democracies, and exerting pressure on Ukraine amid the ongoing conflict. APT28’s global reach extends to Europe, North America, and Asia, targeting government, military, energy, media, and research organizations.

Tactics, Techniques, and Procedures (TTPs)

APT28 employs a sophisticated array of tactics to achieve its objectives, focusing on stealth, persistence, and intelligence gathering. ANSSI and its partners in the C4 group (a coalition of cybersecurity agencies) have documented the following TTPs since 2021:

Phishing Campaigns: APT28 sends spear-phishing emails from compromised or leaked accounts, often targeting personal email addresses to access sensitive data or infiltrate broader systems. In 2024, the group targeted Roundcube email servers to distribute the HeadLace backdoor and launched phishing campaigns against UKR.NET and Yahoo users.
Vulnerability Exploitation: The group exploits known and zero-day vulnerabilities, such as CVE-2023-23397, a critical Microsoft Outlook privilege escalation flaw patched in March 2023. This allowed attackers to steal Net-NTLMv2 hashes for relay attacks, granting unauthorized access to mailboxes.
Brute-Force Attacks: APT28 conducts brute-force attacks on webmail and other systems, attempting multiple username and password combinations to gain entry.
Low-Cost Infrastructure: To evade detection, the group uses rented servers, free hosting services, VPNs, and temporary email services. Compromised routers and dynamic domain name resolution services, such as Mocky.IO, further conceal their infrastructure.
Malware and Tools: APT28 deploys custom implants like CredoMap and OceanMap stealers to exfiltrate data. Unlike typical campaigns, the group often avoids persistent backdoors, compromising poorly monitored edge devices like routers to minimize detection.
Strategic Intelligence Focus: In 2024, APT28 prioritized governmental, diplomatic, research, and think tank entities across France, Europe, Ukraine, and North America, seeking sensitive geopolitical and defense-related information.

These TTPs reflect APT28’s adaptability, with techniques evolving to counter improved defenses while maintaining a focus on low-cost, high-impact operations.

Targets and Impact

Targeted Entities

Since 2021, APT28 has compromised or targeted a diverse range of French organizations, including:

Government Ministries and Local Administrations: Seeking access to policy documents and diplomatic communications.
Defense and Aerospace Firms: Targeting intellectual property and military technology data.
Think Tanks: Focusing on institutions studying geopolitics, defense, and international relations, particularly those influencing NATO and EU policies.
Financial and Economic Sectors: Aiming to gather economic intelligence and disrupt financial stability.
Sports Organizations: Notably, an entity involved in the 2024 Paris Olympics, indicating an intent to disrupt or surveil major international events.
Media and Research Organizations: Targeting outlets and institutes to influence public opinion or steal strategic insights.

ANSSI noted that APT28’s victimology in 2024 extended beyond France to include Ukraine, NATO member states, and non-NATO countries like Jordan and the UAE, reflecting a broad intelligence-gathering agenda.

Impact on France

The cyberattacks have had significant operational and strategic consequences:

Data Exfiltration: APT28’s focus on strategic intelligence suggests the theft of sensitive government, defense, and geopolitical data, which could be used to inform Russian foreign policy or undermine French interests.
Destabilization Efforts: By targeting high-profile entities and leaking data, as seen in the 2017 Macron campaign hack, APT28 aims to sow discord and erode public trust in French institutions.
Operational Disruption: While no major outages were reported, the compromise of critical systems could disrupt government and defense operations, particularly if edge devices like routers are exploited.
Reputational Damage: The attacks, especially those tied to the Olympics, risk damaging France’s image as a secure host for global events.

The broader impact includes heightened public and political awareness of cyber threats, prompting France to bolster its cybersecurity posture and international cooperation.

Geopolitical Context

Russia’s Cyber Strategy

APT28’s campaign aligns with Russia’s broader “hybrid warfare” strategy, which combines cyberattacks, disinformation, and political interference to destabilize adversaries. The group’s activities intensified following Russia’s 2022 invasion of Ukraine, with France’s strong support for Kyiv—through military aid and sanctions—making it a prime target. APT28’s focus on Ukraine’s infrastructure, alongside attacks on France and other NATO allies, reflects Russia’s intent to weaken Western unity and pressure supporters of Ukraine.

The group’s operations often coincide with politically sensitive periods, such as elections or international events like the Olympics, to maximize disruption. For example, the 2017 Macron leaks were timed to influence the presidential vote, and the 2024 Olympics-related attack suggests an attempt to embarrass France on the global stage.

International Reactions

France is not alone in facing APT28’s aggression. Other nations have issued similar accusations:

Germany: In May 2024, Germany attributed cyberattacks on its defense, aerospace, and political institutions to APT28.
Norway: In 2020, Norway linked APT28 to a cyberattack on its parliament’s email system, with sensitive data extracted.
Czech Republic: In 2020, the Czech National Cyber and Information Security Agency reported APT28’s likely involvement in a breach of a strategic institution.
Ukraine: APT28 has exerted “continual pressure” on Ukrainian infrastructure since 2022, often operating from GRU Unit 20728.

The EU has imposed sanctions on individuals and entities linked to APT28, signaling a coordinated Western response to Russia’s cyber activities.

France’s Response and Mitigation

Government Actions

France’s public attribution reflects a strategic shift toward transparency to deter future attacks and rally international support. Foreign Minister Jean-Noel Barrot raised the issue at the UN Security Council, demanding that Russia halt APT28’s activities. The government has pledged to use “all means at its disposal” to anticipate, deter, and respond to Russia’s cyber aggression, including through diplomatic pressure and potential sanctions.

ANSSI’s detailed report provides actionable recommendations for organizations, including:

Patch Management: Apply updates for vulnerabilities like CVE-2023-23397 to prevent exploitation.
Phishing Defenses: Train employees to recognize phishing emails and enforce multi-factor authentication (MFA).
Network Monitoring: Enhance visibility into edge devices like routers to detect compromises early.
Threat Intelligence Sharing: Collaborate with C4 partners and international allies to track APT28’s evolving TTPs.

France’s commitment to a secure digital environment is part of its broader national defense strategy, with increased investments in cybersecurity infrastructure.

International Collaboration

France is strengthening cyber alliances to counter APT28. The planned “friendship treaty” with Poland, set for May 9, 2025, includes joint efforts to combat Russian cyberattacks and disinformation, particularly ahead of Poland’s presidential election on May 18. President Macron has also signaled that Western allies, including the U.S., will intensify pressure on Russia to secure a ceasefire in Ukraine, with cyber defense as a key component.

Implications for Global Cybersecurity

Evolving Threat Landscape

APT28’s campaign highlights several trends in state-sponsored cyber threats:

Low-Cost, High-Impact Operations: By leveraging inexpensive infrastructure and open-source tools, APT28 achieves significant results with minimal investment.
Think Tank Targeting: The focus on think tanks underscores their role in shaping policy, making them prime targets for espionage.
Election Interference: APT28’s history of election-related attacks, including in France and the U.S., raises concerns about future interference, particularly in France’s 2027 elections.
Hybrid Warfare: Russia’s integration of cyberattacks with geopolitical objectives exemplifies the growing role of cyber operations in modern conflicts.

Policy and Defense Recommendations

To counter APT28 and similar threats, organizations and governments should:

Adopt Zero Trust Architecture: Assume networks are compromised and enforce strict access controls.
Enhance Attribution Capabilities: Invest in forensic tools to trace attacks, as demonstrated by France’s identification of APT28’s Rostov-on-Don base.
Strengthen Public-Private Partnerships: Collaborate with cybersecurity firms to share threat intelligence and develop defenses.
Promote Cyber Norms: Advocate for international agreements to deter state-sponsored cyberattacks, despite challenges with enforcement.

Geopolitical Ramifications

APT28’s attacks could further strain Russia’s relations with the West, particularly as France and its allies push for a resolution to the Ukraine conflict. The public attribution may prompt retaliatory cyberattacks from Russia, escalating the cyber conflict. Meanwhile, France’s leadership in calling out APT28 could galvanize NATO and EU efforts to counter Russian cyber operations, potentially leading to stricter sanctions or coordinated cyber defenses.

Conclusion

France’s accusations against Russia’s GRU and its APT28 unit reveal a persistent and sophisticated cyber espionage campaign targeting the heart of French governance, defense, and society. Since 2021, APT28 has exploited vulnerabilities, deployed phishing campaigns, and used low-cost infrastructure to steal strategic intelligence and destabilize France. ANSSI’s detailed findings and France’s public attribution signal a bold response to Russia’s cyber aggression, driven by the need to protect national security and inform the public. As geopolitical tensions rise, particularly over Ukraine, APT28’s actions underscore the growing role of cyberattacks in hybrid warfare. France’s call for international cooperation and robust defenses sets a precedent for countering state-sponsored threats, but the challenge of deterring a determined adversary like APT28 remains. The global cybersecurity community must remain vigilant, as Russia’s cyber operations show no signs of abating.

Sources

France Ministry for Europe and Foreign Affairs, “Russia – Attribution of cyber attacks on France to the Russian military intelligence service (APT28)”
Reuters, “France accuses Russian intelligence of repeated cyber attacks since 2021”
BleepingComputer, “France ties Russian APT28 hackers to 12 cyberattacks on French orgs”
ANSSI, “CERTFR-2025-CTI-007: APT28-linked threat report”
The Record, “France blames Russian military intelligence for years of cyberattacks on local entities”
France24, “France accuses Russia of cyberattacks on defence, finance, media sectors”
Hackread, “From TV5Monde to Govt: France Blames Russia’s APT28 for Cyberattacks”
The Verge, “France publicly attributes ‘Macron-leaks’ to the Kremlin and APT28”
Posts on X by @visegrad24, @FaytuksNetwork, @RymMomtaz, @PeterClifford1, @LeylaShirvani