C0051: APT28 Nearest Neighbor Campaign

C0051: APT28 Nearest Neighbor Campaign describes [APT28 Nearest Neighbor Campaign](https://attack.mitre.org/campaigns/C0051) was conducted by [APT28](https://attack.mitre.org/groups/G0007) from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining mul...

Executive priority

C0051: APT28 Nearest Neighbor Campaign is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate C0051: APT28 Nearest Neighbor Campaign by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether C0051: APT28 Nearest Neighbor Campaign appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT28 Nearest Neighbor Campaign

APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques18 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1003.003	NTDSSub-technique	During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via `vssadmin`.[1]
Enterprise	T1567	Exfiltration Over Web Service	During APT28 Nearest Neighbor Campaign, APT28 exfiltrated data over public-facing webservers – such as Google Drive.[1]
Enterprise	T1059.001	PowerShellSub-technique	During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet `Get-ChildItem` to access credentials, among other PowerShell functions deployed.[1]
Enterprise	T1560.001	Archive via UtilitySub-technique	During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (`Compress-Archive` cmdlet) to compress collected data.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	During APT28 Nearest Neighbor Campaign, APT28 used `cmd.exe` for execution.[1]
Enterprise	T1686.003	Windows Host FirewallSub-technique	During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems.[1]
Enterprise	T1110.003	Password SprayingSub-technique	During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials.[1]
Enterprise	T1016.002	Wi-Fi DiscoverySub-technique	During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.[1]
Enterprise	T1669	Wi-Fi Networks	During APT28 Nearest Neighbor Campaign, APT28 established wireless connections to secure, enterprise Wi-Fi networks belonging to a target organization for initial access into the environment.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.[1]
Enterprise	T1074.001	Local Data StagingSub-technique	During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the `C:\ProgramData` directory.[1]
Enterprise	T1021.001	Remote Desktop ProtocolSub-technique	During APT28 Nearest Neighbor Campaign, APT28 used RDP for lateral movement.[1]
Enterprise	T1003.002	Security Account ManagerSub-technique	During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: `reg save hklm\sam, reg save hklm\system,` and `reg save hklm\security`.[1]
Enterprise	T1561.001	Disk Content WipeSub-technique	During APT28 Nearest Neighbor Campaign, APT28 used the native Microsoft utility cipher.exe to securely wipe files and folders – overwriting the deleted data using `cmd.exe /c cipher /W:C`.[1]
Enterprise	T1584	Compromise Infrastructure	During APT28 Nearest Neighbor Campaign, APT28 compromised third-party infrastructure in physical proximity to targets of interest for follow-on activities.[1]
Enterprise	T1021.002	SMB/Windows Admin SharesSub-technique	During APT28 Nearest Neighbor Campaign, APT28 leveraged SMB to transfer files and move laterally.[1]
Enterprise	T1090.001	Internal ProxySub-technique	During APT28 Nearest Neighbor Campaign, APT28 used the built-in `netsh portproxy` command to create internal proxies on compromised systems.[1]
Enterprise	T1006	Direct Volume Access	During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing `vssadmin` in order to dump the NTDS.dit file.[1]

Associated objects

Groups, software, and campaigns

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

S0108: netsh

netsh is a scripting utility used to interact with networking components on local or remote systems. [1]

Windows

S1205: cipher.exe

cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).[1]

Windows

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.0
Created: Feb 25, 2025, 17:11 UTC (UTC+00:00)
Modified: Jul 31, 2026, 21:11 UTC (UTC+00:00)
Raw hash: 30765bb7d9e55383...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Jul 31, 2026, 21:11 UTC (UTC+00:00)	Current bundle	`30765bb7d9e5…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	May 12, 2026, 15:12 UTC (UTC+00:00)	Older bundle	`f5feeeb5bdf5…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Nearest Neighbor Volexity
Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.
Open source URL
[2]
mitre-attackC0051
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use