apt29-cozy-bear

• SKILL.mdcore · 19,535 bytes

# APT29 (Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes) — Adversary Emulation Profile

APT29 (MITRE ATT&CK **G0016**; also tracked as Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, CozyDuke, UNC2452, Dark Halo, NobleBaron, YTTRIUM, Blue Kitsune, IRON RITUAL/IRON HEMLOCK) is a Russian state-sponsored cyber-espionage group attributed by multiple governments to Russia's Foreign Intelligence Service (SVR). Active since at least 2008, it is among the most operationally disciplined intrusion sets on record: it favors patient, stealthy, long-dwell access against high-value strategic targets, custom and living-off-the-land tooling, rigorous operational security (residential-proxy infrastructure, anti-forensic indicator removal, low-and-slow authentication attacks), and a sustained pivot toward cloud and identity-plane attacks (Microsoft 365 / Entra ID, OAuth, federation). It is best known for the 2015–2016 DNC intrusion, the 2020 SolarWinds Orion supply-chain compromise, and the 2024 Microsoft corporate-email breach. This profile teaches Decepticon to emulate APT29's signature TTPs so an authorized red team can exercise the blue cell against a realistic, identity-and-cloud-centric espionage adversary.

## Attribution & motivation

- **Suspected sponsor / nation:** Russian Federation — Foreign Intelligence Service (Sluzhba Vneshney Razvedki, **SVR**). Attribution is publicly asserted by the U.S. government (CISA/FBI/NSA), the UK NCSC, Canada's CSE, and corroborated by vendor reporting (Mandiant/Google, Microsoft, CrowdStrike).
- **Motivation:** Strategic **espionage** — collection of foreign-policy, diplomatic, defense, government, and technology intelligence in support of Russian state interests. APT29 is not financially motivated and is not primarily a destructive actor; its goal is durable, covert access and exfiltration of intelligence, not disruption.
- **Confidence:** **High** for SVR attribution — it is the consensus of multiple Five Eyes governments and independent commercial vendors, reinforced by consistent tradecraft across a decade-plus of operations.

## Targeting

- **Sectors:** National governments and foreign ministries, diplomatic missions/embassies, think tanks and policy research institutes, defense and military organizations, IT and managed/cloud service providers (used as a stepping stone to downstream victims), technology companies, healthcare/pharmaceutical and vaccine research (2020), and aviation/education/law enforcement (post-SolarWinds expansion).
- **Regions:** Primarily NATO and Western-aligned states — United States, United Kingdom, Europe broadly, and other governments of intelligence interest to Russia.