Actors/Nation-state / APT/Europe

APT29

G0016APTRU · Russia

AKA BlueBravo · Dark Halo · NobleBaron · Office Monkeys · The Dukes · NOBELIUM · IRON HEMLOCK · YTTRIUM · SilverFish · StellarParticle · EuroAPT · Group 100 · ITG11 · UNC2452

Proofpoint: TA421Kaspersky: CozyDukeMicrosoft: Midnight BlizzardCrowdStrike: COZY BEARSecureworks: IRON RITUALPwC: Blue KitsuneMITRE: G0016ESET: Dukes

Russian SVR cyber-espionage group; perpetrators of the SolarWinds supply-chain compromise.

Targets25

Sectors14

Threat types1

GIRs mapped0/480

Active since2008

Explore in atlas

Also tracked as

9 vendor names · 14 other aliases

Open Rosetta Stone

CrowdStrike

COZY BEAR

ESET

Dukes

Kaspersky

CozyDuke

Mandiant

APT29

Microsoft

Midnight Blizzard

MITRE

G0016

Proofpoint

TA421

PwC

Blue Kitsune

Secureworks

IRON RITUAL

UNATTRIBUTED ALIASESBlueBravoDark HaloNobleBaronOffice MonkeysThe DukesNOBELIUMIRON HEMLOCKYTTRIUMSilverFishStellarParticleEuroAPTGroup 100ITG11UNC2452

Victimology

Geographic footprint · 25 countries

Export STIX

origin · Russiatargeted countries · 25

EUROPE · 14

Austria · Germany · Denmark · Spain · France · United Kingdom · Greece · Hungary · Montenegro · Netherlands · Norway · Poland · Portugal · Ukraine

AMERICAS · 3

Brazil · Mexico · United States

ASIA · 7

China · Israel · Japan · South Korea · Mongolia · Türkiye · Uzbekistan

OCEANIA · 1

New Zealand

Sectors targeted

14 of 40

Government100 actors Aerospace58 actors Financial Services73 actors Healthcare46 actors Pharmaceutical26 actors Technology60 actors NGOs & Dissidents56 actors Energy / Utilities58 actors Oil and Gas21 actors Education & Research62 actors Media & Journalism48 actors Industrials / Engineering28 actors Private Sector (generic)29 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 43 techniques

Resource Development · 1

T1583.006Web Services

Initial Access · 5

T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment T1566.002Spearphishing Link T1566.003Spearphishing via Service

Execution · 8

T1047Windows Management Instrumentation

Persistence · 4

T1037Boot or Logon Initialization Scripts T1037.004RC Scripts

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 5

T1003.002Security Account Manager T1003.004LSA Secrets

Discovery · 1

T1087.004Cloud Account

Lateral Movement · 2

T1021.007Cloud Services

Collection · 2

T1005Data from Local System T1114.002Remote Email Collection

Command And Control · 6

T1090.003Multi-hop Proxy

Stealth · 8

T1027.002Software Packing T1027.006HTML Smuggling

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer43 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.006Python

T1059.009Cloud API

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1651Cloud Administration Command

T1098.002

Additional Email Delegate Permissions

T1547.001Registry Run Keys / Startup Folder

T1528

Steal Application Access Token

T1621Multi-Factor Authentication Request Generation

T1649Steal or Forge Authentication Certificates

T1550.003

Pass the Ticket

T1090.004

Domain Fronting

T1105Ingress Tool Transfer

T1568Dynamic Resolution

T1573Encrypted Channel

T1665Hide Infrastructure

T1036.005

Match Legitimate Resource Name or Location

T1070.004File Deletion

T1078Valid Accounts

T1078.003Local Accounts

T1078.004Cloud Accounts

T1218.005Mshta