The Sednit espionage group, also known as the Sofacy group, APT28 or Fancy Bear, has been targeting various institutions for many years. We recently discovered a component the group employed to reach physically isolated computer networks – air-gapped networks – and exfiltrate sensitive files from them through removable drives.