APT29

G0016 Russia Espionage MITRE ATT&CK →

Also known as: IRON RITUAL · IRON HEMLOCK · NobleBaron · Dark Halo · NOBELIUM · UNC2452 · YTTRIUM · The Dukes · Cozy Bear · CozyDuke · SolarStorm · Blue Kitsune · UNC3524 · Midnight Blizzard

Overview

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

Targets

Government · Private sector · Think Tanks

Regions

Belgium · Brazil · China · Georgia · Germany · India · Japan · Kazakhstan · Mexico · New Zealand · Portugal · Romania · South Korea · Turkey · Ukraine · United States

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190, T1203
Custom malware/implant development — ATT&CK: 34 attributed custom malware families

TTPs — 66 techniques across 13 tactics

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1583.006 Web Services
T1586.002 Email Accounts
T1586.003 Cloud Accounts
T1587.001 Malware
T1587.003 Digital Certificates
T1588.002 Tool

Defense Impairment

Credential Access

T1003.002 Security Account Manager
T1003.004 LSA Secrets
T1110.001 Password Guessing
T1110.003 Password Spraying
T1528 Steal Application Access Token
T1621 Multi-Factor Authentication Request Generation
T1649 Steal or Forge Authentication Certificates

Discovery

T1016.001 Internet Connection Discovery
T1087.004 Cloud Account

Lateral Movement

T1021.007 Cloud Services
T1550.003 Pass the Ticket

Collection

T1005 Data from Local System
T1114.002 Remote Email Collection

Command and Control

Tools & malware (49)

PinchDuke · ROADTools · WellMail · CozyCar · Mimikatz · meek · TrailBlazer · Tasklist · OnionDuke · FatDuke · POSHSPY · EnvyScout · SoreFang · GeminiDuke · reGeorg · BloodHound · GoldMax · FoggyWeb · SDelete · PolyglotDuke · AADInternals · MiniDuke · TEARDROP · SeaDuke · Sibot · Raindrop · RegDuke · CloudDuke · GoldFinder · AdFind · PsExec · Tor · NativeZone · Systeminfo · ipconfig · SUNSPOT · Impacket · Cobalt Strike · PowerDuke · Net · QUIETEXIT · HAMMERTOSS · BoomBox · Sliver · CosmicDuke · SUNBURST · WellMess · VaporRage · LiteDuke

Reporting (3)

How Microsoft names threat actors — Microsoft
UNC3524: Eye Spy on Your Email — Mandiant
Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign — CrowdStrike