Dear Joohn: The Sofacy Group’s Global Campaign
Summary: Unit 42 reports that the Sofacy group (also tracked as Fancy Bear, APT28, STRONTIUM, Pawn Storm, and Sednit) ran a spear-phishing campaign from mid-October to mid-November 2018, intercepting nine weaponized documents that shared the author name Joohn and delivered Zebrocy or Cannon variants. Targets spanned four continents and included NATO-aligned foreign affairs and government agencies, former USSR state entities, and possible local law enforcement, NGOs, and medical organizations, with emails sent from free Seznam accounts and documents using Word's remote template function to pull a malicious macro from four IP-based C2 servers.
Why it matters: Nine documents built by one operator over roughly a month reached government and law-enforcement targets on four continents, and the average gap between the remote template's last modification and the document appearing in the wild was 13.8 hours - a window most organizations would not notice, let alone close.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026