APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).12 They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.3456 In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.78 Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.91011121314
- White House Imposing Costs RU Gov April 2021
- UK Gov Malign RIS Activity April 2021
- F-Secure The Dukes
- GRIZZLY STEPPE JAR
- Crowdstrike DNC June 2016
- UK Gov UK Exposes Russia SolarWinds April 2021
- NSA Joint Advisory SVR SolarWinds April 2021
- UK NSCS Russia SolarWinds April 2021
- FireEye SUNBURST Backdoor December 2020
- MSTIC NOBELIUM Mar 2021
- CrowdStrike SUNSPOT Implant January 2021
- Volexity SolarWinds
- Cybersecurity Advisory SVR TTP May 2021
- Unit 42 SolarStorm December 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1621 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1528 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1651 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1665 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1649 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.009 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.002 | Security Account Manager | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1016.001 | Internet Connection Discovery | — |
| T1021.007 | Cloud Services | — |
| T1027.001 | Binary Padding | — |
| T1027.002 | Software Packing | — |
| T1027.006 | HTML Smuggling | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1037.004 | RC Scripts | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.006 | Python | — |
| T1059.009 | Cloud API | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1078 | Valid Accounts | — |
| T1078.003 | Local Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1087.004 | Cloud Account | — |
| T1090.002 | External Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1090.004 | Domain Fronting | — |
| T1098.002 | Additional Email Delegate Permissions | — |
| T1098.005 | Device Registration | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.001 | Password Guessing | — |
| T1110.003 | Password Spraying | — |
| T1114.002 | Remote Email Collection | — |
| T1133 | External Remote Services | — |
| T1136.003 | Cloud Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1505.003 | Web Shell | — |
| T1528 | Steal Application Access Token | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1546.008 | Accessibility Features | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1550.003 | Pass the Ticket | — |
| T1553.005 | Mark-of-the-Web Bypass | — |
| T1556.007 | Hybrid Identity | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1568 | Dynamic Resolution | — |
| T1573 | Encrypted Channel | — |
| T1583.006 | Web Services | — |
| T1586.002 | Email Accounts | — |
| T1586.003 | Cloud Accounts | — |
| T1587.001 | Malware | — |
| T1587.003 | Digital Certificates | — |
| T1588.002 | Tool | — |
| T1595.002 | Vulnerability Scanning | — |
| T1621 | Multi-Factor Authentication Request Generation | — |
| T1649 | Steal or Forge Authentication Certificates | — |
| T1651 | Cloud Administration Command | — |
| T1665 | Hide Infrastructure | — |
| T1685.002 | Disable or Modify Cloud Log | — |
别名
APT29 · Blue Kitsune · Cozy Bear · CozyDuke · Dark Halo · IRON HEMLOCK · IRON RITUAL · Midnight Blizzard · NOBELIUM · NobleBaron · SolarStorm · The Dukes · UNC2452 · UNC3524 · YTTRIUM · 舒适熊
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。