CASE DOSSIER fugitive

U.S. v. Netyksho et al. (APT28 / GRU Unit 26165 DNC Hack)

Docket: 1:18-cr-00215 Court: U.S. District Court for the District of Columbia Opened: 2018-07-13 Sector: Political Organizations, Government

Key Facts

Status

FUGITIVE

Legal disposition

Loss Amount

$10.0 million

Extensive campaign disruption and federal investigative expenditure.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: FUGITIVE in U.S. District Court for the District of Columbia.
Primary Target Sector: Political Organizations, Government.
Documented Financial Loss: $10.0 million.
5 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Twelve Russian GRU military intelligence officers charged with hacking into the Democratic National Committee and Hillary Clinton presidential campaign servers, exfiltrating emails, and orchestrating strategic leaks via DCLeaks and Guccifer 2.0.

Procedural & Incident Timeline

2018-07-13 indictment

Special Counsel Robert Mueller unseals 11-count indictment against 12 GRU military officers.

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Dmitriy Sergeyevich Badin	Russian Federation	fugitive	Pending	None	GRU cyber operator indicted in D.D.C. and subject to German federal arrest warrant for the Bundestag intrusion.
Viktor Borisovich Netyksho	Russian Federation	fugitive	Pending	None	Commander of GRU Unit 26165 indicted for the 2016 DNC cyber intrusions.
Boris Alekseyevich Antonov	Russian Federation	fugitive	Pending	None	GRU Unit 26165 department head overseeing spearphishing operations.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1566.002	Spearphishing Link Initial Access	"Conspirators sent spearphishing emails containing spoofed Google security warnings directing campaign staff to enter passwords on adversary domains."	Indictment ¶ 21, Page 8	reviewed
T1059.001	PowerShell Execution	"Defendants used custom X-Agent malware and executed PowerShell scripts to automate file collection across internal exchange servers."	Indictment ¶ 33, Page 14	reviewed
T1583.001	Domains Resource Development	"GRU officers registered misleading domain names such as dcleaks.com and actblues.com using cryptocurrency to stage leaks."	Indictment ¶ 28, Page 12	reviewed
T1071.004	DNS Tunneling Command and Control	"X-Agent malware used DNS tunneling over port 53 to transmit command output across restricted network perimeter firewalls."	Indictment ¶ 35, Page 16	reviewed
T1546.003	Windows Management Instrumentation Event Subscription Persistence	"Adversaries created WMI event filters to ensure backdoor persistence whenever Windows booted."	Indictment ¶ 38, Page 17	reviewed

CISA Cybersecurity Advisories

AA24-057A: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Netyksho et al. (APT28 / GRU Unit 26165 DNC Hack), No. 1:18-cr-00215 (U.S. District Court for the District of Columbia 2018), https://cyberattackcaselibrary.pages.dev/cases/us-v-netyksho-apt28-dnc/

Embeddable Incident Card (HTML):