Actors/Nation-state / APT/Europe

APT29

APTRU · Russia

AKA BlueBravo · Dark Halo · NobleBaron · Office Monkeys · The Dukes · NOBELIUM · IRON HEMLOCK · YTTRIUM · SilverFish · StellarParticle · EuroAPT · Group 100 · ITG11 · UNC2452

CrowdStrike: COZY BEARKaspersky: CozyDukeMicrosoft: Midnight BlizzardSecureworks: IRON RITUAL

Russian SVR cyber-espionage group; perpetrators of the SolarWinds supply-chain compromise.

Targets25

Sectors14

Threat types1

GIRs covered0/480

Active since2008

Victimology

Geographic footprint · 25 countries

origin · Russiatargeted countries · 25

EUROPE · 14

Austria · Germany · Denmark · Spain · France · United Kingdom · Greece · Hungary · Montenegro · Netherlands · Norway · Poland · Portugal · Ukraine

AMERICAS · 3

Brazil · Mexico · United States

ASIA · 7

China · Israel · Japan · South Korea · Mongolia · Türkiye · Uzbekistan

OCEANIA · 1

New Zealand

Sectors targeted

14 of 40

Government83 actors Aerospace49 actors Financial Services61 actors Healthcare38 actors Pharmaceutical24 actors Technology51 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Media & Journalism41 actors Industrials / Engineering23 actors Private Sector (generic)28 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 43 techniques

Resource Development · 1

T1583.006Web Services

Initial Access · 5

T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment T1566.002Spearphishing Link T1566.003Spearphishing via Service

Execution · 8

T1047Windows Management Instrumentation

Persistence · 4

T1037Boot or Logon Initialization Scripts T1037.004RC Scripts

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 5

T1003.002Security Account Manager T1003.004LSA Secrets

Discovery · 1

T1087.004Cloud Account

Lateral Movement · 2

T1021.007Cloud Services

Collection · 2

T1005Data from Local System T1114.002Remote Email Collection

Command And Control · 6

T1090.003Multi-hop Proxy

Stealth · 8

T1027.002Software Packing T1027.006HTML Smuggling

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.006Python

T1059.009Cloud API

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1651Cloud Administration Command

T1098.002

Additional Email Delegate Permissions

T1547.001Registry Run Keys / Startup Folder

T1528

Steal Application Access Token

T1621Multi-Factor Authentication Request Generation

T1649Steal or Forge Authentication Certificates

T1550.003

Pass the Ticket

T1090.004

Domain Fronting

T1105Ingress Tool Transfer

T1568Dynamic Resolution

T1573Encrypted Channel

T1665Hide Infrastructure

T1036.005

Match Legitimate Resource Name or Location

T1070.004File Deletion

T1078Valid Accounts

T1078.003Local Accounts

T1078.004Cloud Accounts

T1218.005Mshta