Dark Halo

Dark Halo is a state-sponsored espionage threat actor tracked in connection with intrusions against a US-based think tank and activity overlapping with the SolarWinds supply-chain compromise. The actor has been publicly associated with the cluster also tracked as UNC2452 and has been linked by multiple public reports to APT29, also known as Cozy Bear, a Russian intelligence-associated threat group widely believed to operate on behalf of the Russian state. Dark Halo is characterized by patient, high-skill, long-duration operations focused primarily on intelligence collection, especially theft of email from selected executives, policy experts, and IT personnel. The actor has demonstrated the ability to maintain persistence for extended periods, re-enter victim environments after remediation, and minimize forensic visibility through selective tooling, cleanup of artifacts, and extensive use of legitimate administrative utilities and native system functionality. Observed tradecraft includes compromise of Microsoft Exchange environments, abuse of Outlook Web App and Exchange administrative interfaces, reconnaissance through Exchange Management Shell PowerShell cmdlets, mailbox export operations, manipulation of ActiveSync settings to authorize attacker-controlled devices, lateral movement via PowerShell and scheduled tasks, and staged exfiltration of collected mail data through Exchange web infrastructure. Dark Halo has also been observed using renamed legitimate tools for directory reconnaissance and relying heavily on living-off-the-land techniques rather than noisy malware deployment when possible. A notable technique attributed to Dark Halo involved bypassing Duo-protected multi-factor authentication for Outlook Web App after deep compromise of the target server. By obtaining the MFA integration secret stored on the compromised server, the actor was able to generate a valid MFA-related session value and access a mailbox using valid credentials without triggering a second-factor challenge. This behavior reflected compromise of trusted integration material within the victim environment rather than exploitation of a vulnerability in the MFA product itself. Dark Halo has been described as highly sophisticated, persistent, and operationally disciplined. Known aliases and related tracking names include UNC2452, APT29, and Cozy Bear.