OLDBAIT
MITRE ATT&CK: S0138 View on attack.mitre.org
Aliases: Sasfis, OLDBAIT
- Malware type
- credential-stealer
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 23 (22 malicious)
- Last IoC activity
- 2026-10-17 16:40:03
- Profile updated
- 2026-07-07 14:54:40
Targeted industries: government-and-public-sector defense-and-aerospace
Targeted regions: country_code:ua country_code:us
Context
OLDBAIT is a credential harvester associated with APT28, targeting government and defense sectors primarily in Ukraine and the United States. This malware is known for its focus on collecting sensitive information to support espionage activities.
Recent IoC activity
22 malicious indicators in Maltiverse are attributed to OLDBAIT (S0138). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 147 Sigma rules
Malware & tools used
- Match Legitimate Resource Name or Location (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Mail Protocols (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- Web Protocols (attack-pattern)
Used by threat actors
- APT28 (threat-actor)
Detection rules
- MALPEDIA_Win_Oldbait_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Oldbait (report)
- secjuice.com — Fancy Bear Review (report)
- Mandiant — Rpt Apt28 (report)
- web.archive.org — Rpt Apt28 (report)
- MITRE ATT&CK — S0138 (report)
- Mandiant — Apt28 Center Of Storm 2017 (report)