APT29

{
  "id": "ATTACK:enterprise:G0016",
  "title": "APT29",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0016",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
  "external_id": "G0016",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:52.748Z",
  "modified": "2026-07-31T18:48:06.517Z",
  "version": "6.2",
  "aliases": [
    "APT29",
    "IRON RITUAL",
    "IRON HEMLOCK",
    "NobleBaron",
    "Dark Halo",
    "NOBELIUM",
    "UNC2452",
    "YTTRIUM",
    "The Dukes",
    "Cozy Bear",
    "CozyDuke",
    "SolarStorm",
    "Blue Kitsune",
    "UNC3524",
    "Midnight Blizzard"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CozyDuke"
    },
    {
      "source_name": "Cozy Bear"
    },
    {
      "source_name": "The Dukes"
    },
    {
      "source_name": "APT29"
    },
    {
      "source_name": "UNC2452"
    },
    {
      "source_name": "UNC3524"
    },
    {
      "source_name": "Midnight Blizzard"
    },
    {
      "source_name": "YTTRIUM"
    },
    {
      "source_name": "NOBELIUM"
    },
    {
      "source_name": "Blue Kitsune"
    },
    {
      "source_name": "IRON HEMLOCK"
    },
    {
      "source_name": "IRON RITUAL"
    },
    {
      "source_name": "NobleBaron"
    },
    {
      "source_name": "SolarStorm"
    },
    {
      "source_name": "Dark Halo"
    },
    {
      "source_name": "Crowdstrike DNC June 2016",
      "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
    },
    {
      "source_name": "Volexity SolarWinds",
      "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
    },
    {
      "source_name": "CrowdStrike SUNSPOT Implant January 2021",
      "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
    },
    {
      "source_name": "CrowdStrike StellarParticle January 2022",
      "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
    },
    {
      "source_name": "GRIZZLY STEPPE JAR",
      "url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
    },
    {
      "source_name": "FireEye APT29 Nov 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
    },
    {
      "source_name": "F-Secure The Dukes",
      "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
    },
    {
      "source_name": "ESET Dukes October 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
    },
    {
      "source_name": "FireEye SUNBURST Backdoor December 2020",
      "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
    },
    {
      "source_name": "SentinelOne NobleBaron June 2021",
      "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
    },
    {
      "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
      "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Unidentified Dec 2018",
      "url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
    },
    {
      "source_name": "MSTIC NOBELIUM May 2021",
      "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
    },
    {
      "source_name": "MSRC Nobelium June 2021",
      "url": "https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/"
    },
    {
      "source_name": "MSTIC Nobelium Toolset May 2021",
      "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
    },
    {
      "source_name": "MSTIC NOBELIUM Mar 2021",
      "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
    },
    {
      "source_name": "NCSC APT29 July 2020",
      "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
    },
    {
      "source_name": "Cybersecurity Advisory SVR TTP May 2021",
      "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
    },
    {
      "source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
      "url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
    },
    {
      "source_name": "PWC WellMess C2 August 2020",
      "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
    },
    {
      "source_name": "PWC WellMess July 2020",
      "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
    },
    {
      "source_name": "Secureworks IRON HEMLOCK Profile",
      "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
    },
    {
      "source_name": "Secureworks IRON RITUAL Profile",
      "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
    },
    {
      "source_name": "UK Gov Malign RIS Activity April 2021",
      "url": "https://www.gov.uk/government/news/russia-uk-and-us-expose-global-campaigns-of-malign-activity-by-russian-intelligence-services"
    },
    {
      "source_name": "UK Gov UK Exposes Russia SolarWinds April 2021",
      "url": "https://www.gov.uk/government/news/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise"
    },
    {
      "source_name": "UK NSCS Russia SolarWinds April 2021",
      "url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
    },
    {
      "source_name": "Unit 42 SolarStorm December 2020",
      "url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/"
    },
    {
      "source_name": "White House Imposing Costs RU Gov April 2021",
      "url": "https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/"
    }
  ]
}