ULTIMATE THREAT HUNTING PLAYBOOK FOR RUSSIAN CYBER OPERATIONS IN A HYBRID THREAT ENVIRONMENT

Summary from the TLDR InfoSec newsletter

A new hybrid threat hunting framework synthesizes four years of Russian cyber operations, including activity from APT28, Sandworm, and APT29, by focusing on shared operational chokepoints across identity, edge infrastructure, and OT rather than brittle IOCs. To highlight the necessity of behavior-based detection, the playbook points to LAMEHUG's dynamic use of the Hugging Face API and CERT-UA data showing APT28 achieving domain-controller compromise in under an hour. Furthermore, the report advocates for correlating physical and cyber telemetry in response to hybrid threats like the Leipzig/Halle drone incident, though it cautions defenders against attributing attacks based solely on geographic or temporal proximity.