- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- State-sponsored
- Agency named
- NSA, SVR
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2008–2026
- Status
- Active
- ATT&CK
- G0016 · 66 techniques
- Sources
- 14 sources carry it
- Identifier
- GINC-APT-0005 · apt29
RussiaWhat it is
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0029
- CrowdStrike
- Cozy Bear
- IBM X-Force
- ITG11
- Mandiant
- APT 29, UNC2452, UNC3524, TEMP.Monkeys
- Microsoft
- Midnight Blizzard, DEV-0473
- MITRE ATT&CK
- G0016
- Proofpoint
- TA421
- PwC
- Blue Dev 5, Blue Kitsune, Blue Nova
- Qihoo 360
- APT-C-42
- Recorded Future
- TAG-11
- Secureworks
- IRON HEMLOCK, IRON RITUAL
- Talos and others
- Group 100
- Thales
- ATK7
- Trend Micro
- Earth Koshchei
- Operations
- Operation “Ghost”, Operation “Office monkeys”, Operation “StellarParticle”
- Other names
- ghost, NOBELIUM, SilverFish, WellMess, APT 29, Cozy Bear, The Dukes, ATK 7, Backswimmer, BlueBravo, Cloaked Ursa, CloudLook, Cozer, Cozy, Cozy Bear (CrowdStrike), Cozy Duke, CozyCar, CozyDuke, Cranefly, Dark Halo, DarkHalo, Dukes, EuroAPT, Eurostrike, Fritillary, Grizzly Steppe, Hagensia, Hammer Toss, ICE RELIC, ICECAP, Midnight Blizzard (Microsoft), Minidionis, NobleBaron, Office Monkeys, Office Monkeys / TEMP.Monkeys, Office Space, SeaDuke, Solar Phoenix, SolarStorm, StellarParticle, The Dukes, UNC2452, Dark Halo, SolarStorm, WellMess - APT-C-42, YTTRIUM
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Chinese and Russian sources
- Qihoo 360Russia
Targets
- Countries
- Australia, Azerbaijan, Belarus, Belgium, Brazil, Bulgaria, Canada, Chechnya, Chile, China, Cyprus, Czech, Denmark, France, Georgia, Germany, Hungary, India, Ireland, Israel, Italy, Japan, Kazakhstan, Kyrgyzstan, Latvia, Lebanon, Lithuania, Luxembourg, Mexico, Montenegro, NATO, Netherlands, New Zealand, Poland, Portugal, Romania, Russia, Singapore, Slovakia, Slovenia, South Korea, Spain, Switzerland, Thailand, Türkiye, Uganda, Ukraine, United Arab Emirates, United Kingdom, United States, Uzbekistan
- Sectors
- Aerospace, Defense, Education, Embassies, Energy, Financial, Government, Government, Administration, Healthcare, Law enforcement, Media, NGOs, Pharmaceutical, Private sector, Telecommunications, Think Tanks, Transportation
Tools
The first 60 of 68 tools and malware families the sources tie to it.
- AADInternals
- ATI-Agent
- AdFind
- AdobeARM
- BloodHound
- BoomBox
- China Chopper
- CloudDuke
- Cobalt Strike
- CosmicDuke
- CozyCar
- CozyDuke
- CrossRat
- Cyber Eye RAT
- CyberGate
- Dark DDoSeR
- EnvyScout
- FatDuke
- FoggyWeb
- GeminiDuke
- Ghost
- GoldFinder
- GoldMax
- Grizzly Steppe
- HAMMERTOSS
- Hammertoss
- Impacket
- LiteDuke
- Mimikatz
- MiniDionis
- MiniDuke
- NativeZone
- Net
- OnionDuke
- POSHSPY
- PinchDuke
- PolyglotDuke
- PowerDuke
- PsExec
- QUIETEXIT
- ROADTools
- RTM
- Raindrop
- RegDuke
- SDelete
- SUNBURST
- SUNSPOT
- SeaDaddy implant developed in Python and compiled with py2exe
- SeaDuke
- Sibot
- Sliver
- Small-Net
- SoreFang
- Spikerush
- Systeminfo
- TEARDROP
- Tadpole
- Tasklist
- Tor
- TrailBlazer
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net