APT 28 targeted Ukrainian civil-society groups using a combination of phishing techniques and compromised Ubiquiti Wi-Fi routers. The phishing emails impersonated documents from a Ukrainian defense think tank, the Center for Defense Strategies.