The Sednit espionage group, also known as the Sofacy group, APT28 or βFancy Bearβ, has been targeting various institutions for many years. We recently discovered a component the group employed to reach physically isolated computer networks -- βair-gappedβ networks -- and exfiltrate sensitive files from them through removable drives.