APT29

Threat actor

Attributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

APT29Our name
Cozy BearCrowdStrike
CozyDukeCrowdStrike
The DukesF-Secure
UNC2452Mandiant
UNC3524Mandiant
Midnight BlizzardMicrosoft
NOBELIUMMicrosoft
YTTRIUMMicrosoft
SolarStormPalo Alto Networks
Blue KitsunePwC
IRON HEMLOCKSecureworks
IRON RITUALSecureworks
NobleBaronSentinelOne
Dark HaloVolexity

Targets

Sectors: Government, NGOs and think tanks

Regions: Europe, NATO members

Source: MITRE ATT&CK

Known techniques

T1003.002Security Account Manager
T1003.004LSA Secrets
T1005Data from Local System
T1016.001Internet Connection Discovery
T1021.007Cloud Services
T1027.001Binary Padding
T1027.002Software Packing
T1027.006HTML Smuggling
T1036.005Match Legitimate Resource Name or Location
T1037Boot or Logon Initialization Scripts
T1037.004RC Scripts
T1047Windows Management Instrumentation
T1053.005Scheduled Task
T1059.001PowerShell
T1059.006Python
T1059.009Cloud API
T1068Exploitation for Privilege Escalation
T1070.004File Deletion
T1070.006Timestomp
T1078Valid Accounts
T1078.003Local Accounts
T1078.004Cloud Accounts
T1087.004Cloud Account
T1090.002External Proxy
T1090.003Multi-hop Proxy
T1090.004Domain Fronting
T1098.002Additional Email Delegate Permissions
T1098.005Device Registration
T1105Ingress Tool Transfer
T1110.001Password Guessing
T1110.003Password Spraying
T1114.002Remote Email Collection
T1133External Remote Services
T1136.003Cloud Account
T1190Exploit Public-Facing Application
T1199Trusted Relationship
T1203Exploitation for Client Execution
T1204.001Malicious Link
T1204.002Malicious File
T1218.005Mshta

Source: MITRE ATT&CK

Recent news

No stories yet.