APT29 (G0016) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

CISA Known Exploited

About APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

View MITRE record ↗

Techniques by Tactic (66)

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1583.006 Web ServicesT1586.002 Email AccountsT1586.003 Cloud AccountsT1587.001 MalwareT1587.003 Digital CertificatesT1588.002 Tool

Initial Access

T1078 Valid AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.006 PythonT1059.009 Cloud APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1651 Cloud Administration Command

Persistence

T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1053.005 Scheduled TaskT1078 Valid AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1098.005 Device RegistrationT1133 External Remote ServicesT1136.003 Cloud AccountT1505.003 Web ShellT1546.003 Windows Management Instrumentation Event SubscriptionT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup FolderT1556.007 Hybrid Identity

Privilege Escalation

T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098.002 Additional Email Delegate PermissionsT1098.005 Device RegistrationT1546.003 Windows Management Instrumentation Event SubscriptionT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control

Stealth

T1027.001 Binary PaddingT1027.002 Software PackingT1027.006 HTML SmugglingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1218.005 Mshta

Defence Impairment

T1553.005 Mark-of-the-Web BypassT1556.007 Hybrid IdentityT1685.002 Disable or Modify Cloud Log

Credential Access

T1003.002 Security Account ManagerT1003.004 LSA SecretsT1110.001 Password GuessingT1110.003 Password SprayingT1528 Steal Application Access TokenT1556.007 Hybrid IdentityT1621 Multi-Factor Authentication Request GenerationT1649 Steal or Forge Authentication Certificates

Discovery

T1016.001 Internet Connection DiscoveryT1087.004 Cloud Account

Lateral Movement

T1021.007 Cloud ServicesT1550.003 Pass the Ticket

Collection

T1005 Data from Local SystemT1114.002 Remote Email Collection

Command & Control

T1090.002 External ProxyT1090.003 Multi-hop ProxyT1090.004 Domain FrontingT1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573 Encrypted ChannelT1665 Hide Infrastructure

Toolsets (49)

🐛

BoomBox S0635

Malware · Windows

🐛

CloudDuke S0054

Malware · Windows

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

CosmicDuke S0050

Malware · Windows

🐛

CozyCar S0046

Malware · Windows

🐛

EnvyScout S0634

Malware · Windows

🐛

FatDuke S0512

Malware · Windows

🐛

FoggyWeb S0661

Malware · Windows

🐛

GeminiDuke S0049

Malware · Windows

🐛

GoldFinder S0597

Malware · Windows

🐛

GoldMax S0588

Malware · Windows, Linux

🐛

HAMMERTOSS S0037

Malware · Windows

🐛

LiteDuke S0513

Malware · Windows

🐛

MiniDuke S0051

Malware · Windows

🐛

NativeZone S0637

Malware · Windows

🐛

OnionDuke S0052

Malware · Windows

🐛

POSHSPY S0150

Malware · Windows

🐛

PinchDuke S0048

Malware · Windows

🐛

PolyglotDuke S0518

Malware · Windows

🐛

PowerDuke S0139

Malware · Windows

🐛

QUIETEXIT S1084

Malware · Network Devices

🐛

Raindrop S0565

Malware · Windows

🐛

RegDuke S0511

Malware · Windows

🐛

SUNBURST S0559

Malware · Windows

🐛

SUNSPOT S0562

Malware · Windows

🐛

SeaDuke S0053

Malware · Windows

🐛

Sibot S0589

Malware · Windows

🐛

SoreFang S0516

Malware · Windows

🐛

TEARDROP S0560

Malware · Windows

🐛

TrailBlazer S0682

Malware · Windows

🐛

VaporRage S0636

Malware · Windows

🐛

WellMail S0515

Malware · Windows

🐛

WellMess S0514

Malware · Windows

🐛

reGeorg S1187

Malware · Network Devices, Windows, macOS, Linux

🔧

AADInternals S0677

Tool · Windows, Office Suite, Identity Provider

🔧

AdFind S0552

Tool · Windows

🔧

BloodHound S0521

Tool · Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

PsExec S0029

Tool · Windows

🔧

ROADTools S0684

Tool · Identity Provider

🔧

SDelete S0195

Tool · Windows

🔧

Sliver S0633

Tool · Windows, Linux, macOS

🔧

Systeminfo S0096

Tool

🔧

Tasklist S0057

Tool

🔧

Tor S0183

Tool · Linux, Windows, macOS

🔧

ipconfig S0100

Tool

🔧

meek S0175

Tool · Linux, Windows, macOS

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (29)

↑