modified: 2025-04-04T17:07:43.344Z
name: APT29
description: [APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)

In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)
aliases: APT29
IRON RITUAL
IRON HEMLOCK
NobleBaron
Dark Halo
NOBELIUM
UNC2452
YTTRIUM
The Dukes
Cozy Bear
CozyDuke
SolarStorm
Blue Kitsune
UNC3524
Midnight Blizzard
x_mitre_deprecated: no
x_mitre_version: 6.2
x_mitre_contributors: Daniyal Naeem, BT Security
Matt Brenton, Zurich Insurance Group
Katie Nickels, Red Canary
Joe Gumke, U.S. Bank
Liran Ravich, CardinalOps
Vicky Ray, RayvenX
type: intrusion-set
spec_version: 2.1
id: intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542
created: 2017-05-31T21:31:52.748Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0016
external_id: G0016
source_name: CozyDuke
description: (Citation: Crowdstrike DNC June 2016)
source_name: Cozy Bear
description: (Citation: Crowdstrike DNC June 2016)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: CrowdStrike StellarParticle January 2022)
source_name: The Dukes
description: (Citation: F-Secure The Dukes)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)
source_name: APT29
description: (Citation: F-Secure The Dukes)(Citation: FireEye APT29 Nov 2018)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)
source_name: UNC2452
description: (Citation: FireEye SUNBURST Backdoor December 2020)
source_name: UNC3524
description: (Citation: Mandiant APT29 Eye Spy Email Nov 22)
source_name: Midnight Blizzard
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: YTTRIUM
description: (Citation: Microsoft Unidentified Dec 2018)
source_name: NOBELIUM
description: (Citation: MSTIC NOBELIUM Mar 2021)(Citation: MSTIC NOBELIUM May 2021)(Citation: MSTIC Nobelium Toolset May 2021)(Citation: MSRC Nobelium June 2021)
source_name: Blue Kitsune
description: (Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)
source_name: IRON HEMLOCK
description: (Citation: Secureworks IRON HEMLOCK Profile)
source_name: IRON RITUAL
description: (Citation: Secureworks IRON RITUAL Profile)
source_name: NobleBaron
description: (Citation: SentinelOne NobleBaron June 2021)
source_name: SolarStorm
description: (Citation: Unit 42 SolarStorm December 2020)
source_name: Dark Halo
description: (Citation: Volexity SolarWinds)
source_name: Crowdstrike DNC June 2016
description: Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
url: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
source_name: Volexity SolarWinds
description: Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
url: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
source_name: CrowdStrike SUNSPOT Implant January 2021
description: CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
url: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/
source_name: CrowdStrike StellarParticle January 2022
description: CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
url: https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/
source_name: GRIZZLY STEPPE JAR
description: Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE – Russian Malicious Cyber Activity. Retrieved January 11, 2017.
url: https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf
source_name: FireEye APT29 Nov 2018
description: Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.
url: https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
source_name: F-Secure The Dukes
description: F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
url: https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf
source_name: ESET Dukes October 2019
description: Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
url: https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
source_name: FireEye SUNBURST Backdoor December 2020
description: FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
url: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
source_name: SentinelOne NobleBaron June 2021
description: Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021.
url: https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/
source_name: Mandiant APT29 Eye Spy Email Nov 22
description: Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.
url: https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft Unidentified Dec 2018
description: Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019.
url: https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
source_name: MSTIC NOBELIUM May 2021
description: Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021.
url: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
source_name: MSRC Nobelium June 2021
description: MSRC. (2021, June 25). New Nobelium activity. Retrieved August 4, 2021.
url: https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/
source_name: MSTIC Nobelium Toolset May 2021
description: MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
url: https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
source_name: MSTIC NOBELIUM Mar 2021
description: Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
url: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
source_name: NCSC APT29 July 2020
description: National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.
url: https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
source_name: Cybersecurity Advisory SVR TTP May 2021
description: NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.
url: https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf
source_name: NSA Joint Advisory SVR SolarWinds April 2021
description: NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021.
url: https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF
source_name: PWC WellMess C2 August 2020
description: PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.
url: https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html
source_name: PWC WellMess July 2020
description: PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
url: https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html
source_name: Secureworks IRON HEMLOCK Profile
description: Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.
url: http://www.secureworks.com/research/threat-profiles/iron-hemlock
source_name: Secureworks IRON RITUAL Profile
description: Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022.
url: https://www.secureworks.com/research/threat-profiles/iron-ritual
source_name: UK Gov Malign RIS Activity April 2021
description: UK Gov. (2021, April 15). UK and US expose global campaign of malign activity by Russian intelligence services . Retrieved April 16, 2021.
url: https://www.gov.uk/government/news/russia-uk-and-us-expose-global-campaigns-of-malign-activity-by-russian-intelligence-services
source_name: UK Gov UK Exposes Russia SolarWinds April 2021
description: UK Gov. (2021, April 15). UK exposes Russian involvement in SolarWinds cyber compromise . Retrieved April 16, 2021.
url: https://www.gov.uk/government/news/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise
source_name: UK NSCS Russia SolarWinds April 2021
description: UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021.
url: https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise
source_name: Unit 42 SolarStorm December 2020
description: Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023.
url: https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/
source_name: White House Imposing Costs RU Gov April 2021
description: White House. (2021, April 15). Imposing Costs for Harmful Foreign Activities by the Russian Government. Retrieved April 16, 2021.
url: https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5