Home / Threat actors / APT29

APT29 G0016

🔔 Create alert

Also known as: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

6

associated CVEs

87

Techniques

49

Malware and tools

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-36934 High · 7.8 KEV Microsoft Windows SAM Local Privilege Escalation Vulnerability

“APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.”

CVE-2020-0688 High · 8.8 KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

“SolarWinds Compromise: During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.”

CVE-2019-9670 Critical · 9.8 KEV Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2019-19781 Critical · 9.8 KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2019-11510 Critical · 10.0 KEV Ransomware Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2018-13379 Critical · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

Techniques by tactic

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1583.006 Web Services T1586.002 Email Accounts T1586.003 Cloud Accounts T1587.001 Malware T1587.003 Digital Certificates T1588.002 Tool

Initial Access

T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.006 Python T1059.009 Cloud API T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1651 Cloud Administration Command

Persistence

T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1133 External Remote Services T1136.003 Cloud Account T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1556.007 Hybrid Identity

Privilege Escalation

T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control

Stealth

T1027.001 Binary Padding T1027.002 Software Packing T1027.006 HTML Smuggling T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1218.005 Mshta

Defense Impairment

T1553.005 Mark-of-the-Web Bypass T1556.007 Hybrid Identity T1685.002 Disable or Modify Cloud Log

Credential Access

T1003.002 Security Account Manager T1003.004 LSA Secrets T1110.001 Password Guessing T1110.003 Password Spraying T1528 Steal Application Access Token T1556.007 Hybrid Identity T1621 Multi-Factor Authentication Request Generation T1649 Steal or Forge Authentication Certificates

Discovery

T1016.001 Internet Connection Discovery T1087.004 Cloud Account

Lateral Movement

T1021.007 Cloud Services T1550.003 Pass the Ticket

Collection

T1005 Data from Local System T1114.002 Remote Email Collection

Command and Control

T1090.002 External Proxy T1090.003 Multi-hop Proxy T1090.004 Domain Fronting T1105 Ingress Tool Transfer T1568 Dynamic Resolution T1573 Encrypted Channel T1665 Hide Infrastructure

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.