APT29
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 75 incidents
- Sources
- 42 sources
- First seen
- 2014-01-01
- Last seen
- 2024-06-26
- Updated
- 2026-10-14 11:05
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
APT29, also known as Cozy Bear, Nobelium, The Dukes, and Midnight Blizzard, is a Russian state‑sponsored threat group linked to the Foreign Intelligence Service (SVR). The group primarily targets diplomatic entities, government agencies, political organizations, and critical infrastructure in Europe and the United States, conducting cyber espionage to gather intelligence supporting Russian geopolitical objectives. Its tactics include spear‑phishing campaigns, password spraying, exploitation of legitimate cloud services such as Google Drive and Dropbox for command‑and‑control and data exfiltration, abuse of Windows Credential Roaming and DLL sideloading, and deployment of malware families including WINELOADER, ROOTSAW, GoldMax, TrailBlazer, and the Sunburst backdoor used in the SolarWinds supply‑chain compromise. Notable operations attributed to APT29 include the 2020 SolarWinds intrusion affecting multiple U.S. federal agencies, a 2022 campaign leveraging Google Drive and Dropbox against Western diplomatic missions, a 2024 phishing effort delivering WINELOADER to German political parties, and the 2024 TeamViewer corporate network breach attributed to Midnight Blizzard.
Incidents
Attributed incidents are available to members.
75 incidentsSources
Sources available to members: 42 sources.