APT29

APT29 is a Russian state-sponsored threat actor publicly attributed by several governments to the Russian Foreign Intelligence Service (SVR). It is also known as Cozy Bear, The Dukes, NOBELIUM, UNC2452, Dark Halo, NobleBaron, SolarStorm, StellarParticle, Cloaked Ursa, CozyDuke, and Midnight Blizzard. The group is heavily focused on diplomatic and political intelligence collection, principally targeting Europe and NATO member states, and has also targeted technology companies, IT service providers, political parties, government organizations, NGOs, IGOs, think tanks, and Microsoft 365 accounts in NATO countries. The content describes APT29 as highly capable in cloud environments and focused on covering its tracks to evade detection and removal. Reported tradecraft includes spearphishing campaigns using malicious Microsoft Word documents, PDFs, and LNK files; password spraying against cloud tenants lacking MFA; abuse of a compromised or malicious OAuth application with elevated Exchange Online permissions to access email; use of HTTP for command and control and data exfiltration during the SolarWinds compromise; PowerShell-based account discovery using Get-ADUser and Get-ADGroupMember; and use of 7-Zip to decode Raindrop malware during SolarWinds. The content also notes use of Golden SAML and compromise of Azure AD service principals for persistence and lateral movement in the SolarWinds context. Specific activity referenced in the content includes spearphishing against NATO members and defense contractors in Poland and Germany, targeting of Microsoft 365 accounts in NATO countries for foreign policy intelligence, the SolarWinds compromise, and the November 2023 intrusion into Microsoft’s corporate environment that Microsoft disclosed in January 2024. In that Microsoft incident, APT29 reportedly password-sprayed a non-production tenant without MFA and then used a malicious or compromised test OAuth application with elevated privileges to access employee email, including leadership and legal mailboxes. The content also references Microsoft’s reporting on MagicWeb, a post-compromise capability attributed to NOBELIUM/Midnight Blizzard, used to maintain access by backdooring AD FS servers and manipulating authentication claims to bypass policies including MFA. APT29 is described as having a long history of spearphishing against NATO members, especially diplomatic entities, and as having breached executive agencies across Europe and the United States on several occasions.