Nation-State Actor
APT29 (Cozy Bear)
Russia • Active since 2008
APT29 is a Russian government hacking team that's been active since 2008. They're the ones behind the massive SolarWinds hack that hit thousands of companies and government agencies. They specialize in sneaking into networks and staying hidden for months or years while stealing secrets. If you're in government, healthcare, or work with sensitive data, they may be interested in you.
Overview
APT29, also known as Cozy Bear, is a sophisticated threat group attributed to Russia's Foreign Intelligence Service (SVR). They're responsible for high-profile attacks including the 2020 SolarWinds supply chain compromise that affected thousands of organizations worldwide. APT29 specializes in long-term intelligence gathering operations targeting government, diplomatic, think tank, healthcare, and energy sectors.
Also Known As
Cozy Bear, The Dukes, NOBELIUM, Midnight Blizzard, UNC2452
Target Industries
Government, Diplomatic missions, Think tanks, Healthcare, Energy, Technology, Financial services
Target Regions
United States, Europe, NATO countries, Ukraine
Is your business exposed?
Tactics, Techniques & Procedures
- • Supply chain compromise
- • Spear-phishing with malicious attachments
- • OAuth token theft
- • Password spraying
- • Living off the land techniques
- • Cloud service abuse
Known Tools & Malware
SUNBURST (SolarWinds backdoor), TEARDROP, Cobalt Strike, WellMess, WellMail, BEATDROP, BOOMMIC
Notable Campaigns
SolarWinds Supply Chain Attack (2020)
Compromised SolarWinds Orion software updates, affecting 18,000+ organizations including US government agencies.
Democratic National Committee Breach (2016)
Infiltrated DNC networks alongside APT28, exfiltrating emails and documents.
COVID-19 Vaccine Research Targeting (2020)
Targeted vaccine research organizations in the US, UK, and Canada.
MITRE ATT&CK Techniques
T1195.002, T1566.001, T1078, T1550.001, T1027, T1059.001
Defense Recommendations
- 1.
Audit software supply chain and vendor access
- 2.
Implement MFA on all cloud services and admin accounts
- 3.
Monitor for anomalous OAuth token usage
- 4.
Review SolarWinds and similar monitoring tool configurations
- 5.
Enable advanced audit logging for Azure AD/Entra ID
Related Threat Actors
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required