APT-29

APT29 is a Russian state-linked cyber espionage threat actor widely known as APT29, Cozy Bear, The Dukes, and Nobelium. Multiple cited sources associate the group with Russia’s Foreign Intelligence Service (SVR), while one cited historical report noted it was at one time suspected to be the FSB in the context of the 2016 DNC intrusion. The content consistently describes APT29 as a highly capable espionage-focused actor tied to Russian intelligence services. According to the provided content, APT29 was formally identified by the White House as the SVR hacking unit responsible for the 2020 SolarWinds Orion supply-chain compromise. In that campaign, the actor compromised SolarWinds’ internal network, inserted malware into Orion updates, and used that access to infiltrate high-value victims, including numerous U.S. government agencies and private-sector organizations, then deployed additional malware to compromise internal and cloud environments and steal sensitive information. The content also links the group to the FireEye intrusion, where the attackers were assessed as seeking information related to government customers, and to suspected follow-on activity involving Synnex and attempted access to Microsoft cloud customer applications. The actor is also described as one of the Russian groups present in the 2016 Democratic National Committee breach. CrowdStrike assessed APT29 had been on the DNC network since at least summer 2015 and had prolonged access to email messages, chats, and attachments. The content states CrowdStrike found no evidence that APT29 and APT28 were collaborating inside the DNC network. APT29 has additionally been linked in the provided material to espionage-driven attacks including attempts to steal coronavirus vaccine research. The UK NCSC attributed WellMess malware activity targeting COVID-19 vaccine research institutions to APT29, although Kaspersky noted it could not independently confirm the attribution or health-sector targeting at the time. One cited item also describes APT29 as an example of a group that combines cybersecurity and radio techniques to maintain long-term access, including exploiting IoT or industrial devices, deploying covert RF beacons, and using wireless channels for stealthy data exfiltration.