APT29
Also known as: Cozy Bear, The Dukes, NOBELIUM, Midnight Blizzard, UNC2452, Dark Halo
APT29 is known for patient, stealthy intelligence collection. Its best-known operation, the SolarWinds supply-chain compromise, reached thousands of organisations through a trojanised software update. More recently it has focused on cloud and identity: password spraying neglected accounts, abusing OAuth applications and forging authentication tokens to read email.
- Public attribution
- Publicly attributed by the US and UK governments to Russia's Foreign Intelligence Service (SVR); in April 2021 both governments attributed the SolarWinds compromise to the SVR.
- Active since
- Around 2008
- Targets
- Government and diplomatic organisations in Europe and NATO countries
- Think tanks and research institutes
- Technology, IT service and cloud providers (as a route to their customers)
Notable campaigns
2015Democratic National Committee intrusion
Reported to have compromised the DNC starting in the summer of 2015 (MITRE ATT&CK).
2020SolarWinds supply-chain compromise
Malicious code inserted into SolarWinds Orion updates gave access to government and private networks; CISA issued emergency guidance in December 2020.
2023JetBrains TeamCity exploitation
US and allied agencies warned that the SVR was exploiting CVE-2023-42793 in TeamCity servers worldwide.
2024Microsoft corporate email compromise
Microsoft reported that the group password-sprayed a legacy test tenant account without MFA, then abused OAuth applications to access corporate mailboxes.
Signature ATT&CK techniques
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain
- T1110.003Brute Force: Password Spraying
- T1078.004Valid Accounts: Cloud Accounts
- T1621Multi-Factor Authentication Request Generation
- T1098.001Account Manipulation: Additional Cloud Credentials
- T1606.002Forge Web Credentials: SAML Tokens
- T1566.002Phishing: Spearphishing Link
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Enforce MFA on every account, including test tenants, service accounts and break-glass accounts, and disable dormant accounts promptly.
- Review and alert on new OAuth applications, consent grants and credentials added to service principals.
- Protect token-signing keys and federation servers; alert on unusual SAML token issuance or federation changes.
- Verify the integrity of software updates and monitor build systems; watch trusted management software for unexpected network behaviour.
- Patch internet-facing developer and CI/CD servers (such as TeamCity) quickly.