APT29, also called Cozy Bear, The Dukes and Midnight Blizzard, is a Russian cyber espionage group. The US and UK governments attribute it to Russia’s Foreign Intelligence Service (SVR). Since 2020 its best-known work has been inside cloud and identity systems, not malware on laptops. This post covers its names, recent activity and how to defend. For the full sourced record, see our APT29 threat group profile.
| Also known as | Cozy Bear, The Dukes, Midnight Blizzard, NOBELIUM, YTTRIUM, UNC2452 (names listed by MITRE ATT&CK) |
| Attributed to | Russia's Foreign Intelligence Service (SVR) |
| Attributed by | The US government (April 2021), and the UK NCSC with the NSA, CISA, FBI and partners (February 2024 advisory) |
| Active since | At least 2008 (MITRE ATT&CK) |
| MITRE ATT&CK ID | G0016 |
| Main targets | Government networks, think tanks, policy bodies, IT providers and COVID-19 vaccine research (2020) |
What Is APT29 and What Does It Want?
APT29 collects intelligence for Moscow. It is not after a quick payout. The UK NCSC calls it a cyber espionage group that is “almost certainly part of the SVR”. Its goal is long-term access and selective theft of data about diplomacy, defense and technology.
This sets it apart from the other big Russian group, APT28 (Fancy Bear), which governments tie to the military intelligence service GRU (see CISA advisory AA25-141A). Read our Fancy Bear profile for the contrast. APT29 stays quiet and stays long.
APT29 Aliases at a Glance
One group has many names because each security company tracks it by its own evidence. Names can cover overlapping clusters rather than one clean team. MITRE ATT&CK lists these, and the second column shows which company uses each name.
| Name | Used by |
|---|---|
| Cozy Bear | CrowdStrike |
| The Dukes | F-Secure |
| Midnight Blizzard | Microsoft (current naming) |
| NOBELIUM | Microsoft (2021 reports) |
| YTTRIUM | Microsoft (2018) |
| UNC2452 | Mandiant; merged into APT29 in April 2022 |
| Dark Halo | Volexity |
| IRON HEMLOCK | Secureworks |
| SolarStorm | Palo Alto Networks Unit 42 |
| BlueBravo | Recorded Future (Insikt Group; activity it says aligns with APT29) |
How Does APT29 Get In and Stay In?
The February 2024 joint advisory from the UK NCSC, the NSA, CISA, the FBI and partner agencies describes how SVR actors gain cloud access. They use stolen or guessed passwords, then look for weak spots in the account.
Password spraying and brute force. The actors try common passwords against service accounts. These accounts have no human user, so multi-factor authentication often does not cover them.
Dormant accounts. Accounts of former staff that stay on the system are a way in. The advisory says the actors also logged into inactive accounts and followed the password reset steps, which let them regain access after being evicted.
Token theft and MFA bombing. Stolen access tokens let the actors log in without a password. They also push repeated approval requests until a user accepts one.
Residential proxies. Traffic routed through home internet ranges looks like normal users, so blocking by IP address works less well.
Once inside, MITRE ATT&CK records that APT29 adds credentials to OAuth applications and service principals. During the SolarWinds operation it used SAML tokens made with compromised signing certificates. It also spreads with PowerShell, WMI and scheduled tasks, which are tools already on the system.
Which Malware and Tools Does APT29 Use?
MITRE ATT&CK lists dozens of tools for APT29. These are the ones most often named. Many are tied to one campaign and are not in use today.
| Tool | What it is |
|---|---|
| MiniDuke, CosmicDuke, SeaDuke | Early backdoors and implants from the Dukes toolset (MITRE ATT&CK) |
| WellMess, WellMail | Custom malware in the 2020 COVID-19 vaccine research campaign (UK NCSC advisory) |
| SUNBURST | Backdoor in trojanized SolarWinds Orion updates (Mandiant, MITRE ATT&CK) |
| GoldMax | Backdoor used after the SolarWinds compromise (MITRE ATT&CK) |
| EnvyScout, BoomBox | Phishing dropper and downloader (MITRE ATT&CK) |
| FoggyWeb | Backdoor aimed at identity servers (MITRE ATT&CK) |
Read more in our SUNBURST malware page and the SolarWinds Orion incident page.
What Has APT29 Done Recently?
Microsoft, January 2024. Microsoft said it detected an attack on its corporate systems on January 12, 2024. The actor, which Microsoft calls Midnight Blizzard, began in late November 2023 with a password spray on a legacy test account. It then reached a small share of corporate email accounts, including senior leaders. Microsoft said it found no sign of access to customer environments.
Government advisory, February 2024. Allied agencies published how SVR actors adapt to move into cloud services, as covered above.
RDP file phishing, October 2024. Microsoft reported a spear-phishing campaign it observed from October 22, 2024. The emails carried a signed Remote Desktop Protocol file that connected the victim’s device to a server the actor controlled. Targets included government, higher education, defense and nonprofit groups in dozens of countries, with the most focus on the UK, Europe, Australia and Japan.
Newer reporting may exist. Check the sources below for updates.
- 2008Earliest activityMITRE ATT&CK says the group has been active since at least 2008.
- July 2020COVID-19 vaccine targetingUK, US and Canadian agencies reported APT29 attacks on vaccine research, using WellMess and WellMail.
- December 2020SolarWinds disclosedFireEye (now Mandiant) reported trojanized Orion updates carrying SUNBURST.
- April 2021SVR attributionThe US government attributed the SolarWinds compromise to the SVR.
- January 2024Microsoft corporate emailMicrosoft disclosed the Midnight Blizzard intrusion that began in November 2023.
- February 2024Joint cloud advisoryAllied agencies described how SVR actors gain cloud access.
- October 2024RDP file phishingMicrosoft reported a campaign using signed RDP files.
The SolarWinds operation shows the scale. In February 2021 the White House said about 18,000 organizations had downloaded the malicious update, while nine federal agencies and about 100 private companies were actually compromised.
How Can Defenders Reduce the Risk From APT29?
You cannot stop a state actor outright. You can make it costly and shorten the time it stays. Start with identity, because that is where the 2024 advisory says these actors get in.
- Cover service accounts. Use strong, unique secrets and restrict where they can sign in. MFA often cannot protect them.
- Remove dormant accounts. Disable accounts of former staff and unused test tenants, and review them on a schedule.
- Use phishing-resistant MFA for admins and limit repeated approval prompts to stop MFA bombing.
- Watch OAuth and app changes. Alert on new app registrations, new credentials on service principals and unusual consent grants.
- Block risky file types. Stop outbound RDP connections to unknown servers and block RDP files in email.
- Send identity, cloud and endpoint logs to one place so analysts can read them together.
Run a tabletop exercise with IT, legal, communications and leadership. Agree in advance who can disconnect an OAuth app, rotate secrets and invalidate tokens within minutes.
To see which of your domains and exposed services an actor like this could use, run a free scan with Brandefense Atlas. For ongoing monitoring of your external exposure, see External Attack Surface Management and Cyber Threat Intelligence.
What Should Defenders Close First?
APT29 is a patient SVR-attributed group that favors identity and cloud weaknesses over noisy malware. Dormant accounts, service accounts and unwatched app permissions are the doors it uses. Close those first, watch for the signs above, and rehearse your response.
