Quick links
Press Enter to search, Esc to close
Threat group profile
The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR).
In short
The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). In April 2021 the US and UK attributed the 2020 SolarWinds Orion compromise to the SVR, and MITRE says the group has operated since at least 2008.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT29 | MITRE ATT&CK group G0016; NCSC advisory "APT29 targets COVID-19 vaccine development"; CISA AA21-116A[1, 5, 12] |
| Cozy Bear | MITRE ATT&CK; NCSC advisory 2020; AA24-057A[1, 5, 13] |
| The Dukes | MITRE ATT&CK; NCSC advisory 2020; AA21-116A[1, 5, 12] |
| Midnight Blizzard | MITRE ATT&CK; CISA ED 24-02; AA24-057A[1, 13, 14] |
| NOBELIUM | MITRE ATT&CK associated groups[1] |
| YTTRIUM | MITRE ATT&CK; AA21-116A[1, 12] |
| UNC2452 | MITRE ATT&CK associated groups[1] |
| Dark Halo | MITRE ATT&CK associated groups[1] |
| IRON RITUAL | MITRE ATT&CK associated groups[1] |
| IRON HEMLOCK | MITRE ATT&CK associated groups[1] |
| NobleBaron | MITRE ATT&CK associated groups[1] |
| CozyDuke | MITRE ATT&CK associated groups[1] |
| SolarStorm | MITRE ATT&CK associated groups[1] |
| Blue Kitsune | MITRE ATT&CK associated groups[1] |
| UNC3524 | MITRE ATT&CK associated groups[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
UK NCSC 16 July 2020
Assessed that APT29 (the Dukes, Cozy Bear) is a cyber espionage group almost certainly part of the Russian intelligence services. The NSA agreed.[5]
CISA, FBI, ODNI, NSA 5 January 2021
Said an APT actor, likely Russian in origin, was responsible for most or all of the SolarWinds-related compromises.[7]
US Government (CISA AA20-352A) 15 April 2021
Attributed the SolarWinds activity to the SVR. Page last revised 15 April 2021.[6]
US Treasury 15 April 2021
Said the SVR is responsible for the 2020 exploit of SolarWinds Orion.[9]
UK NCSC and UK government 15 April 2021
Assessed it highly likely the SVR was responsible for access to SolarWinds Orion.[10, 11]
FBI, DHS, CISA 26 April 2021
Attributed the activity to the SVR, also known as APT 29, the Dukes, CozyBear and Yttrium.[12]
CISA, NSA, FBI, UK NCSC and partners 26 February 2024
Said APT29 (Midnight Blizzard, Cozy Bear) is almost certainly part of the SVR.[13]
Sources use different confidence words. On 5 January 2021 CISA, FBI, ODNI and NSA said "likely Russian in origin". The UK NCSC in July 2020 said "almost certainly part of the Russian intelligence services" and in April 2021 "highly likely" for SolarWinds. US documents of April 2021 and later name the SVR directly. Start dates also differ: MITRE dates the SolarWinds campaign from August 2019, CISA AA20-352A says compromises began at least as early as March 2020, and MITRE says SUNBURST was used since at least February 2020. Treasury calls it "the 2020 exploit".
Each entry is attributed to the group by the sources cited.
MITRE says the group has operated since at least 2008.[1]
MITRE lists the campaign Operation Ghost from September 2013 to October 2019.[1]
MITRE says APT29 reportedly compromised the Democratic National Committee starting in summer 2015.[1]
MITRE says WellMess has been used by APT29 since at least 2018.[4]
MITRE dates the campaign from August 2019.[2]
MITRE says SUNBURST was used by APT29 since at least February 2020.[3]
AA20-352A says compromises began at least as early as March 2020.[6]
The NCSC said APT29 targeted COVID-19 vaccine work in Canada, the US and the UK during 2020.[5]
CISA issued ED 21-01 on SolarWinds Orion compromise.[8]
CISA, FBI, ODNI and NSA said an APT actor, likely Russian in origin, was behind the compromises.[7]
MITRE gives January 2021 as the last seen date.[2]
FBI, DHS and CISA published an advisory on SVR operations.[12]
CISA, NSA, FBI and the UK NCSC published SVR cloud access tactics.[13]
CISA said Midnight Blizzard took email between federal agencies and Microsoft.[14]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 16 July 2020 | UK NCSC with Canada's CSE and NSA | AdvisoryNamed APT29 as targeting COVID-19 vaccine development.[5] |
| 13 December 2020 | CISA | Emergency Directive 21-01Agencies told to disconnect or power down affected SolarWinds Orion and reset credentials. Closed 8 January 2026.[8] |
| 5 January 2021 | CISA, FBI, ODNI, NSA | Joint statementSaid an APT actor, likely Russian in origin, was behind the SolarWinds-related compromises.[7] |
| 15 April 2021 | US Treasury | SanctionsDesignated five Russian technology companies and restricted dealings in Russian sovereign debt, in a release that names the SVR for SolarWinds.[9] |
| 15 April 2021 | UK NCSC, UK Foreign Office | Public attributionSaid it was highly likely the SVR was responsible for SolarWinds Orion access.[10, 11] |
| 26 April 2021 | FBI, DHS, CISA | Advisory AA21-116ADescribed SVR techniques and mitigations for network defenders.[12] |
| 26 February 2024 | CISA, NSA, FBI, UK NCSC and partners | Advisory AA24-057ADescribed SVR moves to cloud access, with mitigations.[13] |
| 2 April 2024 | CISA | Emergency Directive 24-02Required agencies to reset credentials exposed in email taken by Midnight Blizzard. Sunset 8 January 2026.[14] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Supply Chain Compromise: Compromise Software Supply Chain T1195.002
The SolarWinds Orion update was trojanized and sent to customers (SUNBURST).[2, 3, 6]
Phishing: Spearphishing Link T1566.002
MITRE lists spearphishing links among the group's delivery methods.[1]
Exploit Public-Facing Application T1190
NCSC and AA21-116A describe exploited VPN and remote access products.[1, 5, 12]
Valid Accounts: Cloud Accounts T1078.004
Cloud accounts, including dormant ones, are used for access.[1, 13]
Brute Force: Password Spraying T1110.003
Multi-Factor Authentication Request Generation T1621
Sends repeated multi-factor authentication requests until a user approves one.[1, 13]
Forge Web Credentials: SAML Tokens T1606.002
Forged SAML tokens from stolen signing certificates, per AA20-352A.[1, 6]
OS Credential Dumping: DCSync T1003.006
MITRE lists DCSync for obtaining credentials from domain controllers.[1]
SUNBURST Malware
Trojanized DLL built to fit the SolarWinds Orion update framework, used since at least February 2020.[3]
WellMess Malware
Lightweight malware with .NET and Golang variants, used since at least 2018 and named in the NCSC 2020 advisory.[4, 5]
WellMail Malware
Custom malware named with WellMess in the NCSC 2020 advisory.[5]
SUNSPOT Malware
Listed by MITRE for the group and tied to the SolarWinds campaign.[1, 2]
TEARDROP Malware
Listed by MITRE for the group and tied to the SolarWinds campaign.[1, 2]
Raindrop Malware
Listed by MITRE for the group and tied to the SolarWinds campaign.[1, 2]
GoldMax Malware
Listed by MITRE for the group and tied to the SolarWinds campaign.[1, 2]
Cobalt Strike Tool
Mimikatz Tool
Credential dumping tool named by MITRE and by AA21-116A.[1, 12]
AdFind Tool
Directory query tool listed by MITRE for the group.[1]
Also linked in our threat library:
Limit repeated approval prompts and train staff to report unexpected ones. AA24-057A describes MFA bombing.
Counters T1621
Remove or disable inactive and former-staff accounts. AA24-057A names this.
Counters T1078.004
Patch VPN and remote access products, as the NCSC and AA21-116A advise.
Counters T1190
Regularly review mailbox settings and permissions, per AA21-116A.
Counters T1114.002
Monitor endpoints for encoded PowerShell and lateral movement, per AA21-116A.
Counters T1059.001
See whether staff email addresses and passwords appear in leaks or stealer logs. The advisories above describe stolen and guessed cloud logins as a main way in.
Find internet-facing VPN and remote access products and cloud sign-in pages that should be patched or closed.
Follow new government advisories on this group and match them to your sectors and regions.
The UK NCSC said in July 2020 that APT29 is almost certainly part of the Russian intelligence services. US and UK governments attributed the SolarWinds compromise to the SVR in April 2021.
The latest government documents I opened date from 2024: AA24-057A (February) and ED 24-02 (April). MITRE updated its page on 31 July 2026. I found no source stating current activity for 2026.
MITRE and a 2021 advisory name government networks, think tanks, policy organizations and IT companies. In 2020 the NCSC added COVID-19 vaccine organizations in Canada, the US and the UK.
Governments describe password spraying, MFA prompt flooding, stolen tokens, dormant accounts, exploited VPN products and the SolarWinds Orion update.
If you are a government body, think tank, IT provider or SolarWinds customer, review the advisories in the source list and check sign-in logs for unusual cloud logins.
Require MFA for all accounts, disable unused accounts, and audit cloud credentials and mailbox permissions.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.