APT29: threat actor profile

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). (MITRE ATT&CK, G0016)

Also known as: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard

Attacks we reported

Not in our reporting in the last 12 months.

66 techniques MITRE has documented for this group

1. Reconnaissance Active Scanning: Vulnerability Scanning T1595.002
2. Resource Development Acquire Infrastructure: Web Services T1583.006 · Compromise Accounts: Email Accounts T1586.002 · Compromise Accounts: Cloud Accounts T1586.003 · Develop Capabilities: Malware T1587.001 · Develop Capabilities: Digital Certificates T1587.003 · Obtain Capabilities: Tool T1588.002
3. Initial Access Valid Accounts T1078 · Valid Accounts: Local Accounts T1078.003 · Valid Accounts: Cloud Accounts T1078.004 · External Remote Services T1133 · Exploit Public-Facing Application T1190 · Trusted Relationship T1199 · Phishing: Spearphishing Attachment T1566.001 · Phishing: Spearphishing Link T1566.002 · Phishing: Spearphishing via Service T1566.003
4. Execution Windows Management Instrumentation T1047 · Scheduled Task/Job: Scheduled Task T1053.005 · Command and Scripting Interpreter: PowerShell T1059.001 · Command and Scripting Interpreter: Python T1059.006 · Command and Scripting Interpreter: Cloud API T1059.009 · Exploitation for Client Execution T1203 · User Execution: Malicious Link T1204.001 · User Execution: Malicious File T1204.002 · Cloud Administration Command T1651
5. Persistence Boot or Logon Initialization Scripts T1037 · Boot or Logon Initialization Scripts: RC Scripts T1037.004 · Scheduled Task/Job: Scheduled Task T1053.005 · Valid Accounts T1078 · Valid Accounts: Local Accounts T1078.003 · Valid Accounts: Cloud Accounts T1078.004 · Account Manipulation: Additional Email Delegate Permissions T1098.002 · Account Manipulation: Device Registration T1098.005 · External Remote Services T1133 · Create Account: Cloud Account T1136.003 · Server Software Component: Web Shell T1505.003 · Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003 · Event Triggered Execution: Accessibility Features T1546.008 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 · Modify Authentication Process: Hybrid Identity T1556.007
6. Privilege Escalation Boot or Logon Initialization Scripts T1037 · Boot or Logon Initialization Scripts: RC Scripts T1037.004 · Scheduled Task/Job: Scheduled Task T1053.005 · Exploitation for Privilege Escalation T1068 · Valid Accounts T1078 · Valid Accounts: Local Accounts T1078.003 · Valid Accounts: Cloud Accounts T1078.004 · Account Manipulation: Additional Email Delegate Permissions T1098.002 · Account Manipulation: Device Registration T1098.005 · Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003 · Event Triggered Execution: Accessibility Features T1546.008 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 · Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002
7. Stealth Obfuscated Files or Information: Binary Padding T1027.001 · Obfuscated Files or Information: Software Packing T1027.002 · Obfuscated Files or Information: HTML Smuggling T1027.006 · Masquerading: Match Legitimate Resource Name or Location T1036.005 · Indicator Removal: File Deletion T1070.004 · Indicator Removal: Timestomp T1070.006 · Valid Accounts T1078 · Valid Accounts: Local Accounts T1078.003 · Valid Accounts: Cloud Accounts T1078.004 · System Binary Proxy Execution: Mshta T1218.005
8. Defense Impairment Subvert Trust Controls: Mark-of-the-Web Bypass T1553.005 · Modify Authentication Process: Hybrid Identity T1556.007 · Disable or Modify Tools: Disable or Modify Cloud Log T1685.002
9. Credential Access OS Credential Dumping: Security Account Manager T1003.002 · OS Credential Dumping: LSA Secrets T1003.004 · Brute Force: Password Guessing T1110.001 · Brute Force: Password Spraying T1110.003 · Steal Application Access Token T1528 · Modify Authentication Process: Hybrid Identity T1556.007 · Multi-Factor Authentication Request Generation T1621 · Steal or Forge Authentication Certificates T1649
10. Discovery System Network Configuration Discovery: Internet Connection Discovery T1016.001 · Account Discovery: Cloud Account T1087.004
11. Lateral Movement Remote Services: Cloud Services T1021.007 · Use Alternate Authentication Material: Pass the Ticket T1550.003
12. Collection Data from Local System T1005 · Email Collection: Remote Email Collection T1114.002
13. Command and Control Proxy: External Proxy T1090.002 · Proxy: Multi-hop Proxy T1090.003 · Proxy: Domain Fronting T1090.004 · Ingress Tool Transfer T1105 · Dynamic Resolution T1568 · Encrypted Channel T1573 · Hide Infrastructure T1665

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).