Cyb3rWard0g/ATTCKGroups huggingface dataset:
APT28 macro uses the command

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.(Citation: FireEye APT28)(Citation: FireEye APT28 Hospitality Aug 2017)(Citation: MS17-010 March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1037.001|Logon Script (Windows)|An

APT28 loader Trojan adds the Registry key

APT28 has retrieved internal documents from machines inside victim environments, including by using

Forfiles to stage documents before exfiltration.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.(Citation: FireEye APT28)(Citation: FireEye APT28 Hospitality Aug 2017)

APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.(Citation: US District Court Indictment GRU Oct 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1559.002|Dynamic Data Exchange|

APT28 has delivered

JHUHUGIT and

Koadic by executing PowerShell commands through DDE in Word documents.(Citation: McAfee APT28 DDE1 Nov 2017)(Citation: McAfee APT28 DDE2 Nov 2017)(Citation: Palo Alto Sofacy 06-2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1070.004|File Deletion|
APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1134.001|Token Impersonation/Theft|

APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.(Citation: FireEye Op RussianDoll)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Office 365|T1137.002|Office Test|

APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key

APT28 has used

Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.(Citation: Trend Micro Pawn Storm April 2017)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Microsoft STRONTIUM Aug 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|An

APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.(Citation: Unit 42 Playbook Dec 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1550.002|Pass the Hash|
APT28 has used pass the hash for lateral movement.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1025|Data from Removable Media|An

APT28 backdoor may collect the entire contents of an inserted USB device.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT28 has stored captured credential information in a file named pi.log.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1092|Communication Through Removable Media|

APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1546.015|Component Object Model Hijacking|

APT28 has used COM hijacking for persistence by replacing the legitimate

APT28 has used tools to take screenshots from victims.(Citation: ESET Sednit Part 2)(Citation: XAgentOSX 2017)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

APT28 regularly deploys both publicly available (ex:
APT28 regularly deploys both publicly available (ex:

Mimikatz) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018) They have also dumped the LSASS process memory using the MiniDump function.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT28 has used tools to perform keylogging.(Citation: Microsoft SIR Vol 19)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm Dec 2020)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm.

APT28 has also obfuscated payloads with base64, XOR, and RC4.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)(Citation: Talos Seduploader Oct 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows|T1542.003|Bootkit|

APT28 has deployed a bootkit along with

Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of

BlackEnergy.(Citation: ESET Sednit Part 3)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.(Citation: Bitdefender APT28 Dec 2015)(Citation: Microsoft SIR Vol 19)(Citation: Securelist Sofacy Feb 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1091|Replication Through Removable Media|

APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1070.001|Clear Windows Event Logs|

APT28 has cleared event logs, including by using the commands

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.(Citation: FireEye APT28)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1001.001|Junk Data|

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.(Citation: FireEye APT28)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Playbook Dec 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1070.006|Timestomp|

APT28 has performed timestomping on victim files.(Citation: Crowdstrike DNC June 2016)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1090.002|External Proxy|

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router.

APT28 has also used a machine to relay and obscure communications between

CHOPSTICK and their server.(Citation: FireEye APT28)(Citation: Bitdefender APT28 Dec 2015)(Citation: DOJ GRU Indictment Jul 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1218.011|Rundll32|

APT28 executed

CHOPSTICK by using rundll32 commands such as

APT28 also executed a .dll for a first stage dropper using rundll32.exe. An

APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.(Citation: Crowdstrike DNC June 2016)(Citation: Bitdefender APT28 Dec 2015)(Citation: Palo Alto Sofacy 06-2018)(Citation: Unit 42 Playbook Dec 2017)(Citation: ESET Zebrocy May 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)|
APT29 - G0016

Created: 2017-05-31T21:31:52.748Z

Modified: 2023-04-16T22:25:01.191Z

Contributors: Daniyal Naeem, BT Security,Matt Brenton, Zurich Insurance Group,Katie Nickels, Red Canary,Joe Gumke, U.S. Bank

Aliases

APT29,IRON RITUAL,IRON HEMLOCK,NobleBaron,Dark Halo,StellarParticle,NOBELIUM,UNC2452,YTTRIUM,The Dukes,Cozy Bear,CozyDuke,SolarStorm,Blue Kitsune

Description

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)

Techniques Used
Techniques Used

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace|T1098.002|Additional Email Delegate Permissions|

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with

APT29 has gained access to a global administrator account in Azure AD.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT29 has used a compromised account to access an organization's VPN infrastructure.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Azure AD,Windows,SaaS|T1098.005|Device Registration|

APT29 has enrolled a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110.001|Password Guessing|

APT29 has successfully conducted password guessing attacks against a list of mailboxes.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|
APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from  Microsoft 365 tenants.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|IaaS,Azure AD,Office 365,SaaS,Google Workspace|T1059.009|Cloud API|

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API (Citation: MSTIC Nobelium Toolset May 2021)|
|mitre-attack|enterprise-attack|IaaS,Azure AD|T1651|Cloud Administration Command|

APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Office 365,Azure AD,SaaS,IaaS,Google Workspace|T1021.007|Cloud Services|

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.(Citation: Mandiant Remediation and Hardening Strategies for Microsoft 365)|
|mitre-attack|enterprise-attack|Windows,Azure AD,SaaS,Google Workspace,Office 365,IaaS|T1556.007|Hybrid Identity|

APT29 has edited the

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.(Citation: Mandiant APT29 Trello)|
|mitre-attack|enterprise-attack|Windows,Office 365,Linux,macOS,IaaS,SaaS,Azure AD,Google Workspace|T1621|Multi-Factor Authentication Request Generation|

APT29 has used repeated MFA requests to gain access to victim accounts.(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1027.006|HTML Smuggling|
APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.(Citation: ESET T3 Threat Report 2021) |
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.(Citation: ANSSI Nobelium Phishing December 2021)(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1087.004|Cloud Account|

APT29 has conducted enumeration of Azure AD accounts.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,IaaS,Google Workspace,SaaS|T1136.003|Cloud Account|

APT29 can create new users through Azure AD.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

APT29 has used multiple layers of encryption within malware to protect C2 communication.(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.(Citation: ESET T3 Threat Report 2021)|
|mitre-attack|enterprise-attack|Windows|T1553.005|Mark-of-the-Web Bypass|

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.(Citation: ESET T3 Threat Report 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

APT29 has use

APT29 has obtained and used a variety of tools including

Mimikatz,

SDelete,

Tor,

meek, and
APT29 has use

APT29 has obtained and used a variety of tools including

Mimikatz,

SDelete,

Tor,

meek, and

Cobalt Strike.(Citation: Mandiant No Easy Breach)(Citation: F-Secure The Dukes)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.(Citation: SentinelOne NobleBaron June 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

APT29 has conducted brute force password spray attacks.(Citation: MSRC Nobelium June 2021)(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.(Citation: MSTIC NOBELIUM May 2021)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT29 has installed web shells on exploited Microsoft Exchange servers.(Citation: Cybersecurity Advisory SVR TTP May 2021)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.(Citation: Cybersecurity Advisory SVR TTP May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|
APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.(Citation: MSTIC NOBELIUM May 2021)(Citation: Secureworks IRON RITUAL USAID Phish May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT29 has downloaded additional tools and malware onto compromised networks.(Citation: Mandiant No Easy Breach)(Citation: PWC WellMess July 2020)(Citation: F-Secure The Dukes)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

APT29 has used unique malware in many of their operations.(Citation: F-Secure The Dukes)(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Toolset May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.(Citation: SentinelOne NobleBaron June 2021)(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT29 has used compromised identities to access networks via VPNs and Citrix.(Citation: NCSC APT29 July 2020)(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|PRE|T1587.003|Digital Certificates|

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as

HAMMERTOSS.
APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as

HAMMERTOSS.

APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.(Citation: FireEye APT29)(Citation: MSTIC NOBELIUM May 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: NCSC APT29 July 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

APT29 has developed malware variants written in Python.(Citation: Symantec Seaduke 2015)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. (Citation: F-Secure The Dukes)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.(Citation: F-Secure The Dukes)(Citation: MSTIC NOBELIUM May 2021)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|
APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.(Citation: Mandiant No Easy Breach)(Citation: MSTIC NOBELIUM May 2021)(Citation: Secureworks IRON RITUAL USAID Phish May 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.(Citation: F-Secure The Dukes)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: MSTIC NOBELIUM May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|A backdoor used by

APT29 created a

Tor hidden service to forward traffic from the

Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.004|Domain Fronting|

APT29 has used the meek domain fronting plugin for

Tor to hide the destination of C2 traffic.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT29 used UPX to pack files.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1550.003|Pass the Ticket|

APT29 used Kerberos ticket attacks for lateral movement.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|