Activities related to this group are also tracked by Microsoft as “Forest Blizzard” but also known as “Fancy Bear” or “APT28”. Microsoft also revealed that there is evidence that the Russian Federation’s military intelligence agency, the “Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)” is behind the attack.
The company says it's currently working with the Polish Cyber Command division to take action against the threat actors.
