{"actor":{"id":"apt29","name":"APT29","aliases":["BlueBravo","Dark Halo","NobleBaron","Office Monkeys","The Dukes","NOBELIUM","IRON HEMLOCK","YTTRIUM","SilverFish","StellarParticle","EuroAPT","Group 100","ITG11","UNC2452"],"vendor_names":{"mandiant":"APT29","crowdstrike":"COZY BEAR","eset":"Dukes","kaspersky":"CozyDuke","microsoft":"Midnight Blizzard","mitre":"G0016","proofpoint":"TA421","pwc":"Blue Kitsune","secureworks":"IRON RITUAL"},"mitre_gid":"G0016","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"RU","origins":["RU"],"targets":["AT","BR","CN","DE","DK","ES","FR","GB","GR","HU","IL","JP","KR","ME","MN","MX","NL","NO","NZ","PL","PT","TR","UA","US","UZ"],"target_regions":[],"sectors":["aerospace","edu","energy-utilities","extractive-industries","fin","gov","hea","industrials-engineering","med","ngo","oil-and-gas","pharmaceutical","private-sector-generic","tec"],"threat_types":["esp"],"mitre_techniques":["T1003.002","T1003.004","T1005","T1021.007","T1027.002","T1027.006","T1036.005","T1037","T1037.004","T1047","T1053.005","T1059.001","T1059.006","T1059.009","T1068","T1070.004","T1078","T1078.003","T1078.004","T1087.004","T1090.003","T1090.004","T1098.002","T1105","T1114.002","T1190","T1199","T1203","T1204.001","T1218.005","T1528","T1547.001","T1550.003","T1566.001","T1566.002","T1566.003","T1568","T1573","T1583.006","T1621","T1649","T1651","T1665"],"gir_codes":[],"active_since":2008,"brief":"Russian SVR cyber-espionage group; perpetrators of the SolarWinds supply-chain compromise.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:50:14.526193+00:00","updated_at":"2026-07-29T07:05:23.684+00:00","url":"https://aptatlas.net/actors/apt29"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/apt29/stix","navigator":"https://aptatlas.net/api/v1/actors/apt29/navigator"}}