Skip to content
←Back to glossaryCyber

APT28 (Fancy Bear, GRU Unit 26165)

Cyber espionage group tied by the US, UK and European governments to military unit 26165 of Russian military intelligence: the Bundestag in 2015, the US Democratic Party in 2016.

Definition

On July 13, 2018, a US federal grand jury indicted twelve officers of the GRU, Russian military intelligence, for the 2016 intrusion into Democratic Party networks. Nine belonged to military unit 26165, the one security vendors had tracked for years as APT28, Fancy Bear, Sofacy, and now Forest Blizzard at Microsoft. The record is long: the Bundestag in spring 2015, the World Anti-Doping Agency in 2016, the OPCW, the chemical weapons watchdog in The Hague in April 2018. There, four officers were caught by Dutch intelligence in the parking lot of the hotel next door. On October 22, 2020, the European Union sanctioned unit 26165 for the Bundestag attack, under its cyber sanctions regime. For an underwriter, APT28 matters less for what it steals than for the quality of its attribution. It is public, signed by several governments, backed by court filings. That is exactly the case LMA 5564 to 5567 have in mind when they defer to attribution by the state where the affected system sits. A loss signed APT28 has little chance of escaping the state-backed attack exclusion.

Its 7 cross-references, woven across the glossary's 18 categories
APT28 (Fancy Bear, GRU Unit 26165): Cyber glossary illustration, AlgoPolis
Example

Hypothetical: a German consulting firm discovers in 2024 an intrusion into its email, carried out through a router flaw that the BSI and the FBI publicly attributed to unit 26165. Its cyber policy carries LMA 5567. The insurer pays incident response costs, written outside the exclusion in this contract, but reserves its position on business interruption, on the ground that German attribution has already been made.

Read next
CyberAdvanced persistent threat (APT)A sophisticated attacker, often state-sponsored, conducting targeted, discreet and long-lasting intrusions for espionage or sabotage.Read the entry →CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →CyberSandworm (GRU Unit 74455)An attacker group tied to Russian military intelligence, the presumed author of the Ukrainian grid attacks and NotPetya, named in US indictments and EU sanctions.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

APT28, Fancy Bear, Unit 26165, Forest Blizzard, Sofacy

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.