APT29

Introduction

APT29 is threat group that has been attributed to Russia’s Foreign Intelligence Service (SVR). White House Imposing Costs RU Gov April 2021 UK Gov Malign RIS Activity April 2021 They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. F-Secure The Dukes GRIZZLY STEPPE JAR Crowdstrike DNC June 2016 UK Gov UK Exposes Russia SolarWinds April 2021 In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. NSA Joint Advisory SVR SolarWinds April 2021 UK NSCS Russia SolarWinds April 2021 Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm. FireEye SUNBURST Backdoor December 2020 MSTIC NOBELIUM Mar 2021 CrowdStrike SUNSPOT Implant January 2021 Volexity SolarWinds Cybersecurity Advisory SVR TTP May 2021 Unit 42 SolarStorm December 2020

Activities and Tactics

Targeted Sectors: Government, Healthcare, Energy, Think Tanks, Government, Administration, Private sector

Country of Origin: 🇷🇺 Russia

Risk Level: High

First Seen: 2008

Last Activity: 2024

Incident Type: Espionage

Suspected Victims: United States, China, New Zealand, Ukraine, Romania, Georgia, Japan, South Korea, Belgium, Kazakhstan…

Notable Campaigns

• SolarWinds Compromise (C0024): The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign incl
• Operation Ghost (C0023): Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

Tactics, Techniques, and Procedures (TTPs)

• T1621 Multi-Factor Authentication Request Generation
• T1003.002 Security Account Manager
• T1588.002 Tool
• T1090.004 Domain Fronting
• T1528 Steal Application Access Token
• T1568 Dynamic Resolution
• T1068 Exploitation for Privilege Escalation
• T1546.003 Windows Management Instrumentation Event Subscription
• T1547.001 Registry Run Keys / Startup Folder
• T1136.003 Cloud Account
• T1098.005 Device Registration
• T1587.003 Digital Certificates
• T1005 Data from Local System
• T1105 Ingress Tool Transfer
• T1651 Cloud Administration Command
• T1566.001 Spearphishing Attachment
• T1078.004 Cloud Accounts
• T1053.005 Scheduled Task
• T1016.001 Internet Connection Discovery
• T1587.001 Malware
• T1583.006 Web Services
• T1090.003 Multi-hop Proxy
• T1037 Boot or Logon Initialization Scripts
• T1027.006 HTML Smuggling
• T1070.004 File Deletion
• T1203 Exploitation for Client Execution
• T1550.003 Pass the Ticket
• T1204.001 Malicious Link
• T1036.005 Match Legitimate Resource Name or Location
• T1110.003 Password Spraying
• T1114.002 Remote Email Collection
• T1027.001 Binary Padding
• T1556.007 Hybrid Identity
• T1059.001 PowerShell
• T1133 External Remote Services
• T1037.004 RC Scripts
• T1021.007 Cloud Services
• T1595.002 Vulnerability Scanning
• T1566.002 Spearphishing Link
• T1070.006 Timestomp
• T1586.003 Cloud Accounts
• T1090.002 External Proxy
• T1573 Encrypted Channel
• T1047 Windows Management Instrumentation
• T1110.001 Password Guessing
• T1199 Trusted Relationship
• T1566.003 Spearphishing via Service
• T1078 Valid Accounts
• T1505.003 Web Shell
• T1059.006 Python
• T1665 Hide Infrastructure
• T1218.005 Mshta
• T1003.004 LSA Secrets
• T1190 Exploit Public-Facing Application
• T1553.005 Mark-of-the-Web Bypass
• T1649 Steal or Forge Authentication Certificates
• T1087.004 Cloud Account
• T1098.002 Additional Email Delegate Permissions
• T1078.003 Local Accounts
• T1546.008 Accessibility Features
• T1059.009 Cloud API
• T1586.002 Email Accounts
• T1204.002 Malicious File
• T1685.002 Disable or Modify Cloud Log
• T1548.002 Bypass User Account Control
• T1027.002 Software Packing

ATT&CK technique IDs (denormalized)

• T1003.002
• T1003.004
• T1005
• T1016.001
• T1021.007
• T1027.001
• T1027.002
• T1027.006
• T1036.005
• T1037
• T1037.004
• T1047
• T1053.005
• T1059.001
• T1059.006
• T1059.009
• T1068
• T1070.004
• T1070.006
• T1078
• T1078.003
• T1078.004
• T1087.004
• T1090.002
• T1090.003
• T1090.004
• T1098.002
• T1098.005
• T1105
• T1110.001
• T1110.003
• T1114.002
• T1133
• T1136.003
• T1190
• T1199
• T1203
• T1204.001
• T1204.002
• T1218.005
• T1505.003
• T1528
• T1546.003
• T1546.008
• T1547.001
• T1548.002
• T1550.003
• T1553.005
• T1556.007
• T1566.001
• T1566.002
• T1566.003
• T1568
• T1573
• T1583.006
• T1586.002
• T1586.003
• T1587.001
• T1587.003
• T1588.002
• T1595.002
• T1621
• T1649
• T1651
• T1665
• T1685.002

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 5 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• CosmicDuke
• PinchDuke
• CloudDuke
• HAMMERTOSS
• GeminiDuke
• MiniDuke
• SeaDuke
• RTM
• OnionDuke
• CyberGate
• Hammertoss:
• OnionDuke:
• CosmicDuke:
• MiniDuke:
• CozyDuke:
• SeaDuke:
• SeaDaddy implant developed in Python and compiled with py2exe:
• AdobeARM:
• ATI-Agent:
• MiniDionis:
• Grizzly Steppe:
• Vernaldrop:
• Tadpole:
• Spikerush:
• POSHSPY:
• PolyglotDuke:
• RegDuke:
• FatDuke:

MITRE ATT&CK Software

• PinchDuke (S0048) — malware
• ROADTools (S0684) — tool
• WellMail (S0515) — malware
• CozyCar (S0046) — malware
• Mimikatz (S0002) — tool
• meek (S0175) — tool
• TrailBlazer (S0682) — malware
• Tasklist (S0057) — tool
• OnionDuke (S0052) — malware
• FatDuke (S0512) — malware
• POSHSPY (S0150) — malware
• EnvyScout (S0634) — malware
• SoreFang (S0516) — malware
• GeminiDuke (S0049) — malware
• reGeorg (S1187) — malware
• BloodHound (S0521) — tool
• GoldMax (S0588) — malware
• FoggyWeb (S0661) — malware
• SDelete (S0195) — tool
• PolyglotDuke (S0518) — malware
• AADInternals (S0677) — tool
• MiniDuke (S0051) — malware
• TEARDROP (S0560) — malware
• SeaDuke (S0053) — malware
• Sibot (S0589) — malware
• Raindrop (S0565) — malware
• RegDuke (S0511) — malware
• CloudDuke (S0054) — malware
• GoldFinder (S0597) — malware
• AdFind (S0552) — tool
• PsExec (S0029) — tool
• Tor (S0183) — tool
• NativeZone (S0637) — malware
• Systeminfo (S0096) — tool
• ipconfig (S0100) — tool
• SUNSPOT (S0562) — malware
• Impacket (S0357) — tool
• Cobalt Strike (S0154) — malware
• PowerDuke (S0139) — malware
• Net (S0039) — tool
• QUIETEXIT (S1084) — malware
• HAMMERTOSS (S0037) — malware
• BoomBox (S0635) — malware
• Sliver (S0633) — tool
• CosmicDuke (S0050) — malware
• SUNBURST (S0559) — malware
• WellMess (S0514) — malware
• VaporRage (S0636) — malware
• LiteDuke (S0513) — malware

Russian APT Tool Matrix observations

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [17] Crowdstrike DNC June 2016 Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. [18] Volexity SolarWinds Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020. [19] CrowdStrike SUNSPOT Implant January 2021 CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. [20] CrowdStrike StellarParticle January 2022 CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. [21] GRIZZLY STEPPE JAR Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE – Russian Malicious Cyber Activity. Retrieved January 11, 2017. [22] FireEye APT29 Nov 2018 Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018. [23] F-Secure The Dukes F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. [24] ESET Dukes October 2019 Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. [25] FireEye SUNBURST Backdoor December 2020 FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. [26] SentinelOne NobleBaron June 2021 Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021. [27] Mandiant APT29 Eye Spy Email Nov 22 Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. [28] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [29] Microsoft Unidentified Dec 2018 Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019. [30] MSTIC NOBELIUM May 2021 Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021. [31] MSRC Nobelium June 2021 MSRC. (2021, June 25). New Nobelium activity. Retrieved August 4, 2021. [32] MSTIC Nobelium Toolset May 2021 MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. [33] MSTIC NOBELIUM Mar 2021 Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021. [34] NCSC APT29 July 2020 National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020. [35] Cybersecurity Advisory SVR TTP May 2021 NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021. [36] NSA Joint Advisory SVR SolarWinds April 2021 NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021. [37] PWC WellMess C2 August 2020 PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020. [38] PWC WellMess July 2020 PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020. [39] Secureworks IRON HEMLOCK Profile Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022. [40] Secureworks IRON RITUAL Profile Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. [41] UK Gov Malign RIS Activity April 2021 UK Gov. (2021, April 15). UK and US expose global campaign of malign activity by Russian intelligence services . Retrieved April 16, 2021. [42] UK Gov UK Exposes Russia SolarWinds April 2021 UK Gov. (2021, April 15). UK exposes Russian involvement in SolarWinds cyber compromise . Retrieved April 16, 2021. [43] UK NSCS Russia SolarWinds April 2021 UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021. [44] Unit 42 SolarStorm December 2020 Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023. [45] White House Imposing Costs RU Gov April 2021 White House. (2021, April 15). Imposing Costs for Harmful Foreign Activities by the Russian Government. Retrieved April 16, 2021.

[46] BushidoToken Breach Report Collection - Microsoft breach report (January 2024) via microsoft.com (1) Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: CozyBear (RU APT). [47] BushidoToken Breach Report Collection - Microsoft breach report (January 2024) via microsoft.com (2) Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: CozyBear (RU APT). [48] BushidoToken Breach Report Collection - Microsoft breach report (February 2021) via msrc.microsoft.com Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: CozyBear (RU APT). [49] BushidoToken Breach Report Collection - FireEye breach report (December 2020) via fireeye.com Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: CozyBear (RU APT). [50] BushidoToken Breach Report Collection - SolarWinds breach report (December 2020) via solarwinds.com Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: CozyBear (RU APT).

Recent News

Latest articles from security news feeds mentioning this actor.

• APT29’s Watering Holes Target Thousands of Mobile Users DarkReading — 2026-11-05 — tags: apt
• APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits The Hacker News — 2026-11-04 — tags: apt
• How SentinelOne Blocked APT29’s CaptiveCrunch Campaign SentinelOne — 2026-10-16 — tags: apt