Início / Grupos de ameaça / APT29

APT29 G0016

🔔 Criar alerta

Também conhecido como: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

6

CVEs associadas

87

Técnicas

49

Malwares e ferramentas

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-36934 Alta · 7.8 KEV Microsoft Windows SAM Local Privilege Escalation Vulnerability

“APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.”

CVE-2020-0688 Alta · 8.8 KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

“SolarWinds Compromise: During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.”

CVE-2019-9670 Crítica · 9.8 KEV Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2019-19781 Crítica · 9.8 KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2019-11510 Crítica · 10.0 KEV Ransomware Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

CVE-2018-13379 Crítica · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability

“APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”

Técnicas por tática

Reconhecimento

T1595.002 Vulnerability Scanning

Desenvolvimento de recursos

T1583.006 Web Services T1586.002 Email Accounts T1586.003 Cloud Accounts T1587.001 Malware T1587.003 Digital Certificates T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.006 Python T1059.009 Cloud API T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1651 Cloud Administration Command

Persistência

T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1133 External Remote Services T1136.003 Cloud Account T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1556.007 Hybrid Identity

Escalada de privilégios

T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control

Furtividade

T1027.001 Binary Padding T1027.002 Software Packing T1027.006 HTML Smuggling T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1218.005 Mshta

Comprometimento de defesas

T1553.005 Mark-of-the-Web Bypass T1556.007 Hybrid Identity T1685.002 Disable or Modify Cloud Log

Acesso a credenciais

T1003.002 Security Account Manager T1003.004 LSA Secrets T1110.001 Password Guessing T1110.003 Password Spraying T1528 Steal Application Access Token T1556.007 Hybrid Identity T1621 Multi-Factor Authentication Request Generation T1649 Steal or Forge Authentication Certificates

Descoberta

T1016.001 Internet Connection Discovery T1087.004 Cloud Account

Movimento lateral

T1021.007 Cloud Services T1550.003 Pass the Ticket

Coleta

T1005 Data from Local System T1114.002 Remote Email Collection

Comando e controle

T1090.002 External Proxy T1090.003 Multi-hop Proxy T1090.004 Domain Fronting T1105 Ingress Tool Transfer T1568 Dynamic Resolution T1573 Encrypted Channel T1665 Hide Infrastructure

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.