Loading threat actor…
APT29 is a Russian state-sponsored cyberespionage group linked to Russia’s Foreign Intelligence Service (SVR). Widely used aliases include Midnight Blizzard, Cozy Bear, NOBELIUM, The Dukes, CozyDuke, BlueBravo, and Cloaked Ursa. Its SolarWinds-related activity has also been tracked as UNC2452, Dark Halo, SolarStorm, and StellarParticle. The group targets government and diplomatic institutions, military and defense organizations, think tanks, technology providers, and critical energy infrastructure. Its dominant objective is intelligence collection through covert access to organizational networks and cloud services. APT29 obtains initial access through software supply-chain compromise, exploitation of public-facing applications and remote-access infrastructure, phishing, and compromised identities. It compromised victims through trojanized SolarWinds Orion updates and has exploited vulnerabilities in JetBrains TeamCity, Citrix, Pulse Secure, Fortinet, Zimbra, and WinRAR. It conducts widespread vulnerability scanning and uses compromised accounts to access SSH, VPNs, and other remote services. Post-compromise techniques include Active Directory and remote-system discovery with AdFind, attempts to retrieve Group Managed Service Account passwords, browser-credential theft, data collection and exfiltration, process injection, and persistence through registry startup entries and scheduled execution. The group uses encoded or encrypted payloads, legitimate utilities such as 7-Zip, and TCP- and HTTPS-based command-and-control communications. Associated tooling includes Raindrop and Cobalt Strike. Microsoft tracks Storm-2945 as an operational sub-cluster of Midnight Blizzard; its CaptiveCrunch activity uses compromised captive portals, device-code phishing, ClickFix delivery, ChocoShell PowerShell stagers, and the CornFlake Go backdoor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
72 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
49 malware families attributed to this actor across reporting.
44 additional families tracked in Mallory.
36 CVEs this actor has used in observed campaigns. 36 of them exploited in the wild.
Fortinet researchers reported APT29 exploitation of TeamCity vulnerability CVE-2023-42793 in September 2023, alongside other actors whose activity resembled the observed KrustyLoader/ScreenConnect campaign.
APT29 has exploited CVE-2018-13379 for FortiGate VPNs to gain access.
The table lists CVE-2019-11510 in Ivanti Connect Secure and Policy Secure, multiple associated threat actors, and nine ransomware associations.
APT29 has exploited CVE-2019-19781 for Citrix to gain access. APT41 exploited CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.
APT29 has exploited CVE-2019-9670 in Zimbra software to gain access.
31 more CVEs tied to this actor tracked in Mallory.
1,038 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to an espionage operation targeting more than 20 government, diplomatic, think tank and defense organizations. Anthropic reported AI-assisted implant modification and redeployment, phishing automation and stolen-data collection. Microsoft attributed the associated CaptiveCrunch operation to Storm-2945, assessed as a Midnight Blizzard operational subgroup. ReversingLabs corroborated malware behavior and infrastructure relationships but did not independently establish actor identity or AI authorship of the additional builds.
Named as a possible attribution connection for GTG-20006 based on consistency with public reporting. The content does not confirm that the two names identify the same actor or independently attribute the described operations to Midnight Blizzard.
Mentioned in a background anecdote about intimidation of a security researcher. Beasley interpreted unsolicited Russian gifts delivered to his home as a threat, but the article does not establish that Midnight Blizzard sent them or connect the group to ransomware extortion.
Russian-based espionage group linked by Anthropic and Microsoft to a campaign targeting more than 20 government, diplomatic, think-tank and defense-industrial organizations. The campaign combines Microsoft 365 credential and token theft with PowerShell malware and a Go collection backdoor. Anthropic reports AI-assisted implant rebuilding. ReversingLabs mapped additional infrastructure and related files but explicitly did not independently validate the actor attribution or establish that AI produced the observed rebuilds.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.