Individual skill

apt29

APT29 (Cozy Bear / Midnight Blizzard, SVR) adversary-emulation playbook — malware-light cloud-identity espionage: no-MFA password spray, OAuth consent/token abuse, Golden SAML, mailbox collection over residential proxies. Use when emulating APT29 against an M365/Entra/AWS-identity estate. Triggers on: 'emulate APT29', 'Cozy Bear', 'Midnight Blizzard', 'NOBELIUM', 'OAuth abuse', 'cloud identity espionage', 'Golden SAML'.

packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/apt29/SKILL.md

Read pinned source

Source commit df879550544d36b6b1e69062f05adae28537adf2

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 6,567
Repository last updated: Nov 7, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent Repository topic
ai Repository topic
cybersecurity Repository topic
hacking Repository topic
langchain Repository topic
langgraph Repository topic
llm Repository topic
generative-ai Repository topic
pentesting Repository topic
pentest Repository topic
engineering Derived category

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 7,967 bytes

Read excerpt


# APT29 — Adversary Emulation Playbook

> Tier-3 Russian SVR espionage actor. Emulate **stealth cloud-identity tradecraft**, not
> malware: APT29's modern signature is compromising identity (no-MFA password spray,
> device-code/consent phishing), abusing OAuth applications and tokens for persistence, and
> collecting mail/documents over residential proxies with a near-zero endpoint footprint.
> Authorized red-team emulation only — every action runs under the engagement RoE.

## When to emulate APT29

- Target is a cloud-first / hybrid-identity estate (Microsoft 365 + Entra ID, Okta, AWS IAM
  Identity Center, Google Workspace) and the client wants their **identity blast radius**
  tested the way a top-tier espionage actor would.
- Government, diplomatic, defense, think-tank, technology, or MSP targets (see the