https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... He

https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... Here's the report for how you might detect APT28 in your network. What would evidence look like, to you? Do you want to see the PCAPs? The executables themselves?