Actors/Nation-state / APT/Europe

APT29

G0016APTRU · Russia

AKA BlueBravo · Dark Halo · NobleBaron · Office Monkeys · The Dukes · NOBELIUM · IRON HEMLOCK · YTTRIUM · SilverFish · StellarParticle · EuroAPT · Group 100 · ITG11 · UNC2452

CrowdStrike: COZY BEARESET: DukesKaspersky: CozyDukeMicrosoft: Midnight BlizzardMITRE: G0016Proofpoint: TA421PwC: Blue KitsuneSecureworks: IRON RITUAL

Russian SVR cyber-espionage group; perpetrators of the SolarWinds supply-chain compromise.

Targets25

Sectors14

Threat types1

GIRs covered0/480

Active since2008

Also tracked as

9 vendor names · 14 other aliases

Open Rosetta Stone

CrowdStrike

COZY BEAR

ESET

Dukes

Kaspersky

CozyDuke

Mandiant

APT29

Microsoft

Midnight Blizzard

MITRE

G0016

Proofpoint

TA421

PwC

Blue Kitsune

Secureworks

IRON RITUAL

UNATTRIBUTED ALIASESBlueBravoDark HaloNobleBaronOffice MonkeysThe DukesNOBELIUMIRON HEMLOCKYTTRIUMSilverFishStellarParticleEuroAPTGroup 100ITG11UNC2452

Victimology

Geographic footprint · 25 countries

origin · Russiatargeted countries · 25

EUROPE · 14

Austria · Germany · Denmark · Spain · France · United Kingdom · Greece · Hungary · Montenegro · Netherlands · Norway · Poland · Portugal · Ukraine

AMERICAS · 3

Brazil · Mexico · United States

ASIA · 7

China · Israel · Japan · South Korea · Mongolia · Türkiye · Uzbekistan

OCEANIA · 1

New Zealand

Sectors targeted

14 of 40

Government100 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Media & Journalism49 actors Industrials / Engineering29 actors Private Sector (generic)29 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 43 techniques

Resource Development · 1

T1583.006Web Services

Initial Access · 5

T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment T1566.002Spearphishing Link T1566.003Spearphishing via Service

Execution · 8

T1047Windows Management Instrumentation

Persistence · 4

T1037Boot or Logon Initialization Scripts T1037.004RC Scripts

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 5

T1003.002Security Account Manager T1003.004LSA Secrets

Discovery · 1

T1087.004Cloud Account

Lateral Movement · 2

T1021.007Cloud Services

Collection · 2

T1005Data from Local System T1114.002Remote Email Collection

Command And Control · 6

T1090.003Multi-hop Proxy

Stealth · 8

T1027.002Software Packing T1027.006HTML Smuggling

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer43 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.006Python

T1059.009Cloud API

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1651Cloud Administration Command

T1098.002

Additional Email Delegate Permissions

T1547.001Registry Run Keys / Startup Folder

T1528

Steal Application Access Token

T1621Multi-Factor Authentication Request Generation

T1649Steal or Forge Authentication Certificates

T1550.003

Pass the Ticket

T1090.004

Domain Fronting

T1105Ingress Tool Transfer

T1568Dynamic Resolution

T1573Encrypted Channel

T1665Hide Infrastructure

T1036.005

Match Legitimate Resource Name or Location

T1070.004File Deletion

T1078Valid Accounts

T1078.003Local Accounts

T1078.004Cloud Accounts

T1218.005Mshta