MITRE ATT&CKgroup

G0016 APT29

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard
Version
6.2
Created
2017-05-31

Description

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

Related

Uses · MITRE ATT&CK (115)

  • T1685.002 Disable or Modify Cloud Log sub-technique
  • S1187 reGeorg software (malware)
  • T1665 Hide Infrastructure technique
  • S1084 QUIETEXIT software (malware)
  • T1651 Cloud Administration Command technique
  • T1021.007 Cloud Services sub-technique
  • T1556.007 Hybrid Identity sub-technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T1586.003 Cloud Accounts sub-technique
  • T1621 Multi-Factor Authentication Request Generation technique
  • T1059.009 Cloud API sub-technique
  • T1098.005 Device Registration sub-technique
  • S0684 ROADTools software (tool)
  • S0682 TrailBlazer software (malware)
  • S0677 AADInternals software (tool)
  • S0661 FoggyWeb software (malware)
  • S0636 VaporRage software (malware)
  • S0637 NativeZone software (malware)
  • S0635 BoomBox software (malware)
  • S0634 EnvyScout software (malware)
  • S0633 Sliver software (tool)
  • T1027.006 HTML Smuggling sub-technique
  • S0597 GoldFinder software (malware)
  • T1016.001 Internet Connection Discovery sub-technique
  • S0588 GoldMax software (malware)
  • S0589 Sibot software (malware)
  • T1553.005 Mark-of-the-Web Bypass sub-technique
  • S0565 Raindrop software (malware)
  • S0562 SUNSPOT software (malware)
  • S0560 TEARDROP software (malware)
Show all 115 ›

Referenced by MITRE ATT&CK · attributed to (2)

  • C0024 SolarWinds Compromise campaign
  • C0023 Operation Ghost campaign

References