APT29 — apt.directory

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).¹² They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.³⁴⁵⁶ In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.⁷⁸ Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.⁹¹⁰¹¹¹²¹³¹⁴

White House Imposing Costs RU Gov April 2021
UK Gov Malign RIS Activity April 2021
F-Secure The Dukes
GRIZZLY STEPPE JAR
Crowdstrike DNC June 2016
UK Gov UK Exposes Russia SolarWinds April 2021
NSA Joint Advisory SVR SolarWinds April 2021
UK NSCS Russia SolarWinds April 2021
FireEye SUNBURST Backdoor December 2020
MSTIC NOBELIUM Mar 2021
CrowdStrike SUNSPOT Implant January 2021
Volexity SolarWinds
Cybersecurity Advisory SVR TTP May 2021
Unit 42 SolarStorm December 2020

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicate	object	Valid	Conf.	Evidence
also_known_as	APT29	— → …	100	src_mitre_attck_enterprise
also_known_as	IRON RITUAL	— → …	100	src_mitre_attck_enterprise
also_known_as	IRON HEMLOCK	— → …	100	src_mitre_attck_enterprise
also_known_as	NobleBaron	— → …	100	src_mitre_attck_enterprise
also_known_as	Dark Halo	— → …	100	src_mitre_attck_enterprise
also_known_as	NOBELIUM	— → …	100	src_mitre_attck_enterprise
also_known_as	UNC2452	— → …	100	src_mitre_attck_enterprise
also_known_as	YTTRIUM	— → …	100	src_mitre_attck_enterprise
also_known_as	The Dukes	— → …	100	src_mitre_attck_enterprise
also_known_as	Cozy Bear	— → …	100	src_mitre_attck_enterprise
also_known_as	CozyDuke	— → …	100	src_mitre_attck_enterprise
also_known_as	SolarStorm	— → …	100	src_mitre_attck_enterprise
also_known_as	Blue Kitsune	— → …	100	src_mitre_attck_enterprise
also_known_as	UNC3524	— → …	100	src_mitre_attck_enterprise
also_known_as	Midnight Blizzard	— → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1621	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1003.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1588.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1090.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1528	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1568	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1068	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1546.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1547.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1136.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1098.005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1587.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1105	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1651	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1566.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1078.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1053.005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1016.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1587.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1583.006	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1090.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1037	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1027.006	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1070.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1203	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1550.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1204.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1036.005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1110.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1114.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1027.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1556.007	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1059.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1133	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1037.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1021.007	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1595.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1566.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1070.006	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1586.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1090.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1573	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1047	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1110.001	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1199	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1566.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1078	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1505.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1059.006	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1665	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1218.005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1003.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1190	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1553.005	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1649	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1087.004	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1098.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1078.003	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1546.008	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1059.009	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1586.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1204.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1685.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1548.002	2017 → …	100	src_mitre_attck_enterprise
uses_technique	tech_t1027.002	2017 → …	100	src_mitre_attck_enterprise
also_known_as	舒适熊	— → …	60	src_0e0b2199-b766-47ad-af5a-891db001f83e

Technique use

ATT&CK	Technique	platforms
T1003.002	Security Account Manager	—
T1003.004	LSA Secrets	—
T1005	Data from Local System	—
T1016.001	Internet Connection Discovery	—
T1021.007	Cloud Services	—
T1027.001	Binary Padding	—
T1027.002	Software Packing	—
T1027.006	HTML Smuggling	—
T1036.005	Match Legitimate Resource Name or Location	—
T1037	Boot or Logon Initialization Scripts	—
T1037.004	RC Scripts	—
T1047	Windows Management Instrumentation	—
T1053.005	Scheduled Task	—
T1059.001	PowerShell	—
T1059.006	Python	—
T1059.009	Cloud API	—
T1068	Exploitation for Privilege Escalation	—
T1070.004	File Deletion	—
T1070.006	Timestomp	—
T1078	Valid Accounts	—
T1078.003	Local Accounts	—
T1078.004	Cloud Accounts	—
T1087.004	Cloud Account	—
T1090.002	External Proxy	—
T1090.003	Multi-hop Proxy	—
T1090.004	Domain Fronting	—
T1098.002	Additional Email Delegate Permissions	—
T1098.005	Device Registration	—
T1105	Ingress Tool Transfer	—
T1110.001	Password Guessing	—
T1110.003	Password Spraying	—
T1114.002	Remote Email Collection	—
T1133	External Remote Services	—
T1136.003	Cloud Account	—
T1190	Exploit Public-Facing Application	—
T1199	Trusted Relationship	—
T1203	Exploitation for Client Execution	—
T1204.001	Malicious Link	—
T1204.002	Malicious File	—
T1218.005	Mshta	—
T1505.003	Web Shell	—
T1528	Steal Application Access Token	—
T1546.003	Windows Management Instrumentation Event Subscription	—
T1546.008	Accessibility Features	—
T1547.001	Registry Run Keys / Startup Folder	—
T1548.002	Bypass User Account Control	—
T1550.003	Pass the Ticket	—
T1553.005	Mark-of-the-Web Bypass	—
T1556.007	Hybrid Identity	—
T1566.001	Spearphishing Attachment	—
T1566.002	Spearphishing Link	—
T1566.003	Spearphishing via Service	—
T1568	Dynamic Resolution	—
T1573	Encrypted Channel	—
T1583.006	Web Services	—
T1586.002	Email Accounts	—
T1586.003	Cloud Accounts	—
T1587.001	Malware	—
T1587.003	Digital Certificates	—
T1588.002	Tool	—
T1595.002	Vulnerability Scanning	—
T1621	Multi-Factor Authentication Request Generation	—
T1649	Steal or Forge Authentication Certificates	—
T1651	Cloud Administration Command	—
T1665	Hide Infrastructure	—
T1685.002	Disable or Modify Cloud Log	—

Aliases

APT29 · Blue Kitsune · Cozy Bear · CozyDuke · Dark Halo · IRON HEMLOCK · IRON RITUAL · Midnight Blizzard · NOBELIUM · NobleBaron · SolarStorm · The Dukes · UNC2452 · UNC3524 · YTTRIUM · 舒适熊

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections