自动化接入 · API / MCP EN

组织档案 · G0016

APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

ATT&CK G0016 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2017

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).12 They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.3456 In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.78 Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.91011121314

  1. White House Imposing Costs RU Gov April 2021
  2. UK Gov Malign RIS Activity April 2021
  3. F-Secure The Dukes
  4. GRIZZLY STEPPE JAR
  5. Crowdstrike DNC June 2016
  6. UK Gov UK Exposes Russia SolarWinds April 2021
  7. NSA Joint Advisory SVR SolarWinds April 2021
  8. UK NSCS Russia SolarWinds April 2021
  9. FireEye SUNBURST Backdoor December 2020
  10. MSTIC NOBELIUM Mar 2021
  11. CrowdStrike SUNSPOT Implant January 2021
  12. Volexity SolarWinds
  13. Cybersecurity Advisory SVR TTP May 2021
  14. Unit 42 SolarStorm December 2020

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asAPT29— → …100src_mitre_attck_enterprise
also_known_asIRON RITUAL— → …100src_mitre_attck_enterprise
also_known_asIRON HEMLOCK— → …100src_mitre_attck_enterprise
also_known_asNobleBaron— → …100src_mitre_attck_enterprise
also_known_asDark Halo— → …100src_mitre_attck_enterprise
also_known_asNOBELIUM— → …100src_mitre_attck_enterprise
also_known_asUNC2452— → …100src_mitre_attck_enterprise
also_known_asYTTRIUM— → …100src_mitre_attck_enterprise
also_known_asThe Dukes— → …100src_mitre_attck_enterprise
also_known_asCozy Bear— → …100src_mitre_attck_enterprise
also_known_asCozyDuke— → …100src_mitre_attck_enterprise
also_known_asSolarStorm— → …100src_mitre_attck_enterprise
also_known_asBlue Kitsune— → …100src_mitre_attck_enterprise
also_known_asUNC3524— → …100src_mitre_attck_enterprise
also_known_asMidnight Blizzard— → …100src_mitre_attck_enterprise
uses_techniquetech_t16212017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t15282017 → …100src_mitre_attck_enterprise
uses_techniquetech_t15682017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10682017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1136.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1098.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t16512017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1016.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10372017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0062017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t12032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1550.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1556.0072017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1037.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0072017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1595.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0062017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1586.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t15732017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t11992017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1505.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062017 → …100src_mitre_attck_enterprise
uses_techniquetech_t16652017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t16492017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1098.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0032017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0082017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0092017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1586.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1685.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1548.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0022017 → …100src_mitre_attck_enterprise
also_known_as舒适熊— → …60src_0e0b2199-b766-47ad-af5a-891db001f83e

技术使用

ATT&CK技术platforms
T1003.002Security Account Manager—
T1003.004LSA Secrets—
T1005Data from Local System—
T1016.001Internet Connection Discovery—
T1021.007Cloud Services—
T1027.001Binary Padding—
T1027.002Software Packing—
T1027.006HTML Smuggling—
T1036.005Match Legitimate Resource Name or Location—
T1037Boot or Logon Initialization Scripts—
T1037.004RC Scripts—
T1047Windows Management Instrumentation—
T1053.005Scheduled Task—
T1059.001PowerShell—
T1059.006Python—
T1059.009Cloud API—
T1068Exploitation for Privilege Escalation—
T1070.004File Deletion—
T1070.006Timestomp—
T1078Valid Accounts—
T1078.003Local Accounts—
T1078.004Cloud Accounts—
T1087.004Cloud Account—
T1090.002External Proxy—
T1090.003Multi-hop Proxy—
T1090.004Domain Fronting—
T1098.002Additional Email Delegate Permissions—
T1098.005Device Registration—
T1105Ingress Tool Transfer—
T1110.001Password Guessing—
T1110.003Password Spraying—
T1114.002Remote Email Collection—
T1133External Remote Services—
T1136.003Cloud Account—
T1190Exploit Public-Facing Application—
T1199Trusted Relationship—
T1203Exploitation for Client Execution—
T1204.001Malicious Link—
T1204.002Malicious File—
T1218.005Mshta—
T1505.003Web Shell—
T1528Steal Application Access Token—
T1546.003Windows Management Instrumentation Event Subscription—
T1546.008Accessibility Features—
T1547.001Registry Run Keys / Startup Folder—
T1548.002Bypass User Account Control—
T1550.003Pass the Ticket—
T1553.005Mark-of-the-Web Bypass—
T1556.007Hybrid Identity—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1566.003Spearphishing via Service—
T1568Dynamic Resolution—
T1573Encrypted Channel—
T1583.006Web Services—
T1586.002Email Accounts—
T1586.003Cloud Accounts—
T1587.001Malware—
T1587.003Digital Certificates—
T1588.002Tool—
T1595.002Vulnerability Scanning—
T1621Multi-Factor Authentication Request Generation—
T1649Steal or Forge Authentication Certificates—
T1651Cloud Administration Command—
T1665Hide Infrastructure—
T1685.002Disable or Modify Cloud Log—

别名

APT29 · Blue Kitsune · Cozy Bear · CozyDuke · Dark Halo · IRON HEMLOCK · IRON RITUAL · Midnight Blizzard · NOBELIUM · NobleBaron · SolarStorm · The Dukes · UNC2452 · UNC3524 · YTTRIUM · 舒适熊

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错