APT29
MISPNation-state
RU
Unknown
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)
In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)
Tecniche Utilizzate (66)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1003.002 | Security Account Manager | - |
| T1003.004 | LSA Secrets | - |
| T1005 | Data from Local System | - |
| T1016.001 | Internet Connection Discovery | - |
| T1021.007 | Cloud Services | - |
| T1027.001 | Binary Padding | - |
| T1027.002 | Software Packing | - |
| T1027.006 | HTML Smuggling | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1037 | Boot or Logon Initialization Scripts | - |
| T1037.004 | RC Scripts | - |
| T1047 | Windows Management Instrumentation | - |
| T1053.005 | Scheduled Task | - |
| T1059.001 | PowerShell | - |
| T1059.006 | Python | - |
Riferimenti (10)
- labsblog.f-secure.com - The Dukes 7 Years Of Russian Cyber Espionage
- www2.fireeye.com - Rpt Apt29 Hammertoss.pdf
- us-cert.gov - AR 17 20045 Enhanced Analysis Of GRIZZLY STEPPE Activity.pdf
- fireeye.com - Dissecting One Ofap
- cfr.org - Dukes
- pylos.co - Cozybear In From The Cold
- cloudblogs.microsoft.com - Analysis Of Cyberattack On U S Think Tanks Non Profits Public Sector By Unidentified Attackers
- secureworks.com - Iron Hemlock
- attack.mitre.org - G0016
- unit42.paloaltonetworks.com - Cloaked Ursa
Alias (3207)
Malware Utilizzato (49)
Metadata
| ID: | 55 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |