Sign inStart freeBook a demo

APT29 threat group

APT29 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 72 attack techniques, and to attacks on government and private sector organisations, with 16 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Start free →Book a demo
ShareXLinkedIn
Attack techniques
72
Countries and victims named
16
Thought to operate from
Russia
Suspected backing
Russia
Motive
Espionage
Other names
17
Built from public reporting, with every source listed below.
Overview

Who is APT29?

APT29 has 17 other names in security research. Below is what published reporting says about it, with a link to every report so you can check the detail yourself.

Also known as

Group 100COZY BEARThe DukesMinidionisSeaDukeYTTRIUMIRON HEMLOCKGrizzly SteppeG0016ATK7Cloaked UrsaTA421

Security companies each give the same group their own name, so one group can have many.

What public reporting says

A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '

Public reports about APT29 (12)

How it works

How does APT29 attack? Stage by stage.

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 72 linked to APT29, laid out from first look to final blow. Some techniques belong to more than one stage. Pick a stage to see them. Public reporting also lists 87 more specific variations of them, called sub-techniques.

Stage 9 of 15

Stealing passwords

Collecting usernames, passwords and keys to go further.

11 techniques
  • T1003OS Credential Dumping
  • T1110Brute Force
  • T1528Steal Application Access Token
  • T1539Steal Web Session Cookie
  • T1552Unsecured Credentials
  • T1555Credentials from Password Stores
  • T1556Modify Authentication Process
  • T1558Steal or Forge Kerberos Tickets
  • T1606Forge Web Credentials
  • T1621Multi-Factor Authentication Request Generation
  • T1649Steal or Forge Authentication Certificates
Targets

Who does APT29 go after?

The sectors and places named in public reporting about this group. If yours is on the list, it is worth knowing how they work and which flaws they use.

Sectors (2)

GovernmentPrivate sector
See threats by industry →

Countries and victims named (16)

  1. 01United States
  2. 02China
  3. 03New Zealand
  4. 04Ukraine
  5. 05Romania
  6. 06Georgia
  7. 07Japan
  8. 08South Korea
  9. 09Belgium
  10. 10Kazakhstan
  11. 11Brazil
  12. 12Mexico
  13. 13Turkey
  14. 14Portugal
  15. 15India
  16. 16Germany
Free account

Is APT29 a risk to you?

A public profile tells you who a group is. Your account tells you whether it matters to you: we match the software you run to the flaws threat groups use, and we keep watching, so you hear about anything that affects you as soon as we know.

  • Over 900 group profiles in the app, every claim backed by a quote and a source link.
  • Your sector at a glance: which threat groups and ransomware gangs are hitting it.
  • Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
  • A PDF dossier on any group, ready to send to your board or your IT provider.
Start free →Book a demo
FAQ

Questions about APT29

Something else? Talk to the team →

APT29 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 72 attack techniques, and to attacks on government and private sector organisations, with 16 countries and victims named.

Public reporting places APT29 as operating from Russia, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

In public reporting, sectors named include government and private sector, and 16 countries and victims are named, including United States, China, New Zealand and Ukraine.

Public reporting links APT29 to 72 attack techniques. Most of them are about stealing passwords, staying in and taking control.

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

Get started

Find out what groups like this could use against you.

Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.

Start free →Book a demo

No card neededNothing to installIntelligence and alerts free