# APT29: threat group profile

> APT29 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 72 attack techniques, and to attacks on government and private sector organisations, with 16 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.edgeprotect.io/threat-actors/apt29
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > APT29

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 72 (plus 87 sub-techniques) |
| Countries and victims named | 16 |
| Thought to operate from | Russia |
| Suspected backing | Russia |
| Motive | Espionage |
| Other names | 17 |
| Public reports | 12 |

## Who is APT29?

APT29 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 72 attack techniques, and to attacks on government and private sector organisations, with 16 countries and victims named.

### Also known as

Group 100, COZY BEAR, The Dukes, Minidionis, SeaDuke, YTTRIUM, IRON HEMLOCK, Grizzly Steppe, G0016, ATK7, Cloaked Ursa, TA421, Blue Kitsune, ITG11, BlueBravo, Nobelium, UAC-0029

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '

## How does APT29 attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 72 linked to APT29. Some techniques belong to more than one stage. Public reporting also lists 87 more specific variations of them, called sub-techniques.

### 1. Research (2)

- T1589: Gather Victim Identity Information
- T1595: Active Scanning

### 2. Preparation (6)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1585: Establish Accounts
- T1586: Compromise Accounts
- T1587: Develop Capabilities
- T1588: Obtain Capabilities

### 3. Getting in (6)

- T1078: Valid Accounts
- T1133: External Remote Services
- T1190: Exploit Public-Facing Application
- T1195: Supply Chain Compromise
- T1199: Trusted Relationship
- T1566: Phishing

### 4. Running code (6)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1203: Exploitation for Client Execution
- T1204: User Execution
- T1651: Cloud Administration Command

### 5. Staying in (10)

- T1037: Boot or Logon Initialization Scripts
- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1133: External Remote Services
- T1136: Create Account
- T1505: Server Software Component
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution
- T1556: Modify Authentication Process

### 6. Taking control (9)

- T1037: Boot or Logon Initialization Scripts
- T1053: Scheduled Task/Job
- T1068: Exploitation for Privilege Escalation
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1484: Domain or Tenant Policy Modification
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution
- T1548: Abuse Elevation Control Mechanism

### 7. Hiding (6)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1070: Indicator Removal
- T1078: Valid Accounts
- T1140: Deobfuscate/Decode Files or Information
- T1218: System Binary Proxy Execution

### 8. Disabling defences (5)

- T1484: Domain or Tenant Policy Modification
- T1553: Subvert Trust Controls
- T1556: Modify Authentication Process
- T1685: Disable or Modify Tools
- T1686: Disable or Modify System Firewall

### 9. Stealing passwords (11)

- T1003: OS Credential Dumping
- T1110: Brute Force
- T1528: Steal Application Access Token
- T1539: Steal Web Session Cookie
- T1552: Unsecured Credentials
- T1555: Credentials from Password Stores
- T1556: Modify Authentication Process
- T1558: Steal or Forge Kerberos Tickets
- T1606: Forge Web Credentials
- T1621: Multi-Factor Authentication Request Generation
- T1649: Steal or Forge Authentication Certificates

### 10. Looking around (8)

- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1057: Process Discovery
- T1069: Permission Groups Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1482: Domain Trust Discovery

### 11. Spreading (2)

- T1021: Remote Services
- T1550: Use Alternate Authentication Material

### 12. Gathering data (5)

- T1005: Data from Local System
- T1074: Data Staged
- T1114: Email Collection
- T1213: Data from Information Repositories
- T1560: Archive Collected Data

### 13. Keeping contact (8)

- T1001: Data Obfuscation
- T1071: Application Layer Protocol
- T1090: Proxy
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1568: Dynamic Resolution
- T1573: Encrypted Channel
- T1665: Hide Infrastructure

### 14. Taking data out (1)

- T1048: Exfiltration Over Alternative Protocol

### 15. Causing damage (0)

- None linked in public reporting.

## Who does APT29 go after?

**Sectors:** Government, Private sector

**Countries and victims named:** United States, China, New Zealand, Ukraine, Romania, Georgia, Japan, South Korea, Belgium, Kazakhstan, Brazil, Mexico, Turkey, Portugal, India, Germany

See threats by industry: https://www.edgeprotect.io/industries

## Public reports about APT29

- https://labsblog.f-secure.com/2015/09/17/the-dukes-7-years-of-russian-cyber-espionage/
- https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf
- https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf
- https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
- https://www.cfr.org/interactive/cyber-operations/dukes
- https://pylos.co/2018/11/18/cozybear-in-from-the-cold/
- https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
- https://www.secureworks.com/research/threat-profiles/iron-hemlock
- https://attack.mitre.org/groups/G0016
- https://unit42.paloaltonetworks.com/atoms/cloaked-ursa/
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf
- https://cip.gov.ua/services/cm/api/attachment/download?id=60068

## Frequently asked questions

### Who is APT29?

APT29 is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 72 attack techniques, and to attacks on government and private sector organisations, with 16 countries and victims named.

### Where is APT29 thought to be based?

Public reporting places APT29 as operating from Russia, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does APT29 target?

In public reporting, sectors named include government and private sector, and 16 countries and victims are named, including United States, China, New Zealand and Ukraine.

### How does APT29 attack?

Public reporting links APT29 to 72 attack techniques. Most of them are about stealing passwords, staying in and taking control.

### How do I know if APT29 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact