Skip to content

G0016 APT29

APT29 is threat group that has been attributed to Russia’s Foreign Intelligence Service (SVR).2925 They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.75126

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.2027 Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.917321928

Item Value
ID G0016
Associated Names IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard
Version 6.2
Created 31 May 2017
Last Modified 04 April 2025
Navigation Layer View In ATT&CK® Navigator

Associated Group Descriptions

Name Description
IRON RITUAL 24
IRON HEMLOCK 23
NobleBaron 10
Dark Halo 2
NOBELIUM 17141615
UNC2452 9
YTTRIUM 13
The Dukes 781819
Cozy Bear 1818194
CozyDuke 1
SolarStorm 28
Blue Kitsune 2221
UNC3524 11
Midnight Blizzard 12

Techniques Used

Domain ID Name Use
enterprise T1548 Abuse Elevation Control Mechanism -
enterprise T1548.002 Bypass User Account Control APT29 has bypassed UAC.32
enterprise T1087 Account Discovery During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.2
enterprise T1087.002 Domain Account During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember.424
enterprise T1087.004 Cloud Account APT29 has conducted enumeration of Azure AD accounts.34
enterprise T1098 Account Manipulation -
enterprise T1098.001 Additional Cloud Credentials During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.444
enterprise T1098.002 Additional Email Delegate Permissions APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with ApplicationImpersonation rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding ApplicationImpersonation rights in Exchange to collect emails.3511
enterprise T1098.003 Additional Cloud Roles During the SolarWinds Compromise, APT29 granted company administrator privileges to a newly created service principle.4
enterprise T1098.005 Device Registration APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.3531
enterprise T1583 Acquire Infrastructure -
enterprise T1583.001 Domains For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.1751
enterprise T1583.006 Web Services APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.3614
enterprise T1595 Active Scanning -
enterprise T1595.002 Vulnerability Scanning APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.19
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.2
enterprise T1560 Archive Collected Data -
enterprise T1560.001 Archive via Utility During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.2464
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder APT29 added Registry Run keys to establish persistence.32
enterprise T1037 Boot or Logon Initialization Scripts APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.11
enterprise T1037.004 RC Scripts APT29 has installed a run command on a compromised system to enable malware execution on system startup.11
enterprise T1110 Brute Force -
enterprise T1110.001 Password Guessing APT29 has successfully conducted password guessing attacks against a list of mailboxes.35
enterprise T1110.003 Password Spraying APT29 has conducted brute force password spray attacks.153431
enterprise T1651 Cloud Administration Command APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.34
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.39323323
enterprise T1059.003 Windows Command Shell During the SolarWinds Compromise, APT29 used cmd.exe to execute commands on remote machines.248
enterprise T1059.005 Visual Basic For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.19
enterprise T1059.006 Python APT29 has developed malware variants written in Python.39
enterprise T1059.009 Cloud API APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API 16
enterprise T1586 Compromise Accounts -
enterprise T1586.002 Email Accounts APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.4335
enterprise T1586.003 Cloud Accounts APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.35
enterprise T1584 Compromise Infrastructure -
enterprise T1584.001 Domains For the SolarWinds Compromise, APT29 compromised domains to use for C2.17
enterprise T1136 Create Account -
enterprise T1136.003 Cloud Account APT29 can create new users through Azure AD.34
enterprise T1555 Credentials from Password Stores During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.46
enterprise T1555.003 Credentials from Web Browsers During the SolarWinds Compromise, APT29 stole users’ saved passwords from Chrome.4
enterprise T1213 Data from Information Repositories During the SolarWinds Compromise, APT29 accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.4
enterprise T1213.003 Code Repositories During the SolarWinds Compromise, APT29 downloaded source code from code repositories.49
enterprise T1005 Data from Local System APT29 has stolen data from compromised hosts.11
enterprise T1001 Data Obfuscation -
enterprise T1001.002 Steganography During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.8
enterprise T1074 Data Staged -
enterprise T1074.002 Remote Data Staging During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim’s OWA server.2
enterprise T1140 Deobfuscate/Decode Files or Information During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.45
enterprise T1587 Develop Capabilities -
enterprise T1587.001 Malware APT29 has used unique malware in many of their operations.7321611
enterprise T1587.003 Digital Certificates APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.2221
enterprise T1484 Domain or Tenant Policy Modification -
enterprise T1484.002 Trust Modification During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.2447
enterprise T1482 Domain Trust Discovery During the SolarWinds Compromise, APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.2 They also used AdFind to enumerate domains and to discover trust between federated domains.446
enterprise T1568 Dynamic Resolution APT29 has used Dynamic DNS providers for their malware C2 infrastructure.11
enterprise T1114 Email Collection -
enterprise T1114.002 Remote Email Collection APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.3511
enterprise T1573 Encrypted Channel APT29 has used multiple layers of encryption within malware to protect C2 communication.23
enterprise T1585 Establish Accounts -
enterprise T1585.001 Social Media Accounts For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.8
enterprise T1546 Event Triggered Execution -
enterprise T1546.003 Windows Management Instrumentation Event Subscription APT29 has used WMI event subscriptions for persistence.32
enterprise T1546.008 Accessibility Features APT29 used sticky-keys to obtain unauthenticated, privileged console access.3242
enterprise T1048 Exfiltration Over Alternative Protocol -
enterprise T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim’s OWA servers.2
enterprise T1190 Exploit Public-Facing Application APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.1918
enterprise T1203 Exploitation for Client Execution APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.71914
enterprise T1068 Exploitation for Privilege Escalation APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.33
enterprise T1133 External Remote Services APT29 has used compromised identities to access networks via VPNs and Citrix.1835
enterprise T1083 File and Directory Discovery During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.2
enterprise T1606 Forge Web Credentials -
enterprise T1606.001 Web Cookies During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.2
enterprise T1606.002 SAML Tokens During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.4424
enterprise T1589 Gather Victim Identity Information -
enterprise T1589.001 Credentials For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.4
enterprise T1665 Hide Infrastructure APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.31
enterprise T1562 Impair Defenses -
enterprise T1562.001 Disable or Modify Tools During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.46
enterprise T1562.002 Disable Windows Event Logging During the SolarWinds Compromise, APT29, used AUDITPOL to prevent the collection of audit logs.46
enterprise T1562.004 Disable or Modify System Firewall During the SolarWinds Compromise, APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.46
enterprise T1562.008 Disable or Modify Cloud Logs APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.35
enterprise T1070 Indicator Removal During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.9
enterprise T1070.004 File Deletion APT29 has used SDelete to remove artifacts from victim networks.32
enterprise T1070.006 Timestomp APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.11
enterprise T1070.008 Clear Mailbox Data During the SolarWinds Compromise, APT29 removed evidence of email export requests using Remove-MailboxExportRequest.2
enterprise T1105 Ingress Tool Transfer APT29 has downloaded additional tools and malware onto compromised networks.3222711
enterprise T1680 Local Storage Discovery During the SolarWinds Compromise, APT29 used fsutil to check available free space before executing actions that might create large files on disk.46
enterprise T1036 Masquerading -
enterprise T1036.004 Masquerade Task or Service During the SolarWinds Compromise, APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.2
enterprise T1036.005 Match Legitimate Resource Name or Location APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.1035
enterprise T1556 Modify Authentication Process -
enterprise T1556.007 Hybrid Identity APT29 has edited the Microsoft.IdentityServer.Servicehost.exe.config file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.38
enterprise T1621 Multi-Factor Authentication Request Generation APT29 has used repeated MFA requests to gain access to victim accounts.3031
enterprise T1027 Obfuscated Files or Information -
enterprise T1027.001 Binary Padding APT29 used large size files to avoid detection by security solutions with hardcoded size limits.10
enterprise T1027.002 Software Packing APT29 used UPX to pack files.32
enterprise T1027.003 Steganography During Operation Ghost, APT29 used steganography to hide payloads inside valid images.8
enterprise T1027.006 HTML Smuggling APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.33
enterprise T1588 Obtain Capabilities -
enterprise T1588.002 Tool APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.32711
enterprise T1003 OS Credential Dumping -
enterprise T1003.002 Security Account Manager APT29 has used the reg save command to save registry hives.11
enterprise T1003.004 LSA Secrets APT29 has used the reg save command to extract LSA secrets offline.11
enterprise T1003.006 DCSync During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.47464
enterprise T1069 Permission Groups Discovery During the SolarWinds Compromise, APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.2
enterprise T1069.002 Domain Groups During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.4
enterprise T1566 Phishing -
enterprise T1566.001 Spearphishing Attachment APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.7143323
enterprise T1566.002 Spearphishing Link APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.321437
enterprise T1566.003 Spearphishing via Service APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.14
enterprise T1057 Process Discovery During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.2464
enterprise T1090 Proxy -
enterprise T1090.001 Internal Proxy During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.445
enterprise T1090.002 External Proxy APT29 uses compromised residential endpoints as proxies for defense evasion and network access.31
enterprise T1090.003 Multi-hop Proxy A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.3234
enterprise T1090.004 Domain Fronting APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.32
enterprise T1021 Remote Services -
enterprise T1021.001 Remote Desktop Protocol During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.4
enterprise T1021.002 SMB/Windows Admin Shares During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.4
enterprise T1021.006 Windows Remote Management During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.45
enterprise T1021.007 Cloud Services APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.40
enterprise T1018 Remote System Discovery During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.46
enterprise T1053 Scheduled Task/Job -
enterprise T1053.005 Scheduled Task APT29 has used named and hijacked scheduled tasks to establish persistence.32
enterprise T1505 Server Software Component -
enterprise T1505.003 Web Shell APT29 has installed web shells on exploited Microsoft Exchange servers.1911
enterprise T1528 Steal Application Access Token APT29 uses stolen tokens to access victim accounts, without needing a password.31
enterprise T1649 Steal or Forge Authentication Certificates APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.41
enterprise T1558 Steal or Forge Kerberos Tickets -
enterprise T1558.003 Kerberoasting During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.46
enterprise T1539 Steal Web Session Cookie During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.4
enterprise T1553 Subvert Trust Controls -
enterprise T1553.002 Code Signing During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.9
enterprise T1553.005 Mark-of-the-Web Bypass APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.33
enterprise T1195 Supply Chain Compromise -
enterprise T1195.002 Compromise Software Supply Chain During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.5091946
enterprise T1218 System Binary Proxy Execution -
enterprise T1218.005 Mshta APT29 has use mshta to execute malicious scripts on a compromised host.33
enterprise T1218.011 Rundll32 During the SolarWinds Compromise, APT29 used Rundll32.exe to execute payloads.4446
enterprise T1016 System Network Configuration Discovery -
enterprise T1016.001 Internet Connection Discovery APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.11
enterprise T1199 Trusted Relationship APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.34
enterprise T1552 Unsecured Credentials -
enterprise T1552.004 Private Keys During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.4719
enterprise T1550 Use Alternate Authentication Material During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.4724
enterprise T1550.001 Application Access Token During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.4
enterprise T1550.003 Pass the Ticket APT29 used Kerberos ticket attacks for lateral movement.32
enterprise T1550.004 Web Session Cookie During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged duo-sid cookie to bypass MFA set on an email account.24
enterprise T1204 User Execution -
enterprise T1204.001 Malicious Link APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.1437
enterprise T1204.002 Malicious File APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. 73323
enterprise T1078 Valid Accounts APT29 has used a compromised account to access an organization’s VPN infrastructure.35
enterprise T1078.002 Domain Accounts During the SolarWinds Compromise, APT29 used domain administrators’ accounts to help facilitate lateral movement on compromised networks.4
enterprise T1078.003 Local Accounts APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.31
enterprise T1078.004 Cloud Accounts APT29 has gained access to a global administrator account in Azure AD and has used Service Principal credentials in Exchange.3511
enterprise T1102 Web Service -
enterprise T1102.002 Bidirectional Communication For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.8
enterprise T1047 Windows Management Instrumentation APT29 used WMI to steal credentials and execute backdoors at a future time.32

Software

ID Name References Techniques
S0677 AADInternals 34 Cloud Account:Account Discovery Device Registration:Account Manipulation Cloud Administration Command Cloud Service Discovery PowerShell:Command and Scripting Interpreter Cloud Account:Create Account Data from Cloud Storage Trust Modification:Domain or Tenant Policy Modification Exfiltration Over Alternative Protocol SAML Tokens:Forge Web Credentials Email Addresses:Gather Victim Identity Information Domain Properties:Gather Victim Network Information Hybrid Identity:Modify Authentication Process Multi-Factor Authentication:Modify Authentication Process Modify Registry LSA Secrets:OS Credential Dumping Cloud Groups:Permission Groups Discovery Spearphishing Link:Phishing Spearphishing Link:Phishing for Information Steal Application Access Token Steal or Forge Authentication Certificates Silver Ticket:Steal or Forge Kerberos Tickets Credentials In Files:Unsecured Credentials Private Keys:Unsecured Credentials
S0552 AdFind 48433 Domain Account:Account Discovery Domain Trust Discovery Domain Groups:Permission Groups Discovery Remote System Discovery System Network Configuration Discovery
S0521 BloodHound 33 Domain Account:Account Discovery Local Account:Account Discovery Archive Collected Data PowerShell:Command and Scripting Interpreter Domain Trust Discovery Group Policy Discovery Native API Domain Groups:Permission Groups Discovery Local Groups:Permission Groups Discovery Remote System Discovery System Owner/User Discovery
S0635 BoomBox 16 Domain Account:Account Discovery Email Account:Account Discovery Web Protocols:Application Layer Protocol Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Deobfuscate/Decode Files or Information Execution Guardrails Exfiltration to Cloud Storage:Exfiltration Over Web Service File and Directory Discovery Ingress Tool Transfer Masquerading Obfuscated Files or Information Rundll32:System Binary Proxy Execution System Information Discovery System Owner/User Discovery Malicious File:User Execution Web Service
S0054 CloudDuke 7 Web Protocols:Application Layer Protocol Ingress Tool Transfer Bidirectional Communication:Web Service
S0154 Cobalt Strike 919141610332437 Sudo and Sudo Caching:Abuse Elevation Control Mechanism Bypass User Account Control:Abuse Elevation Control Mechanism Parent PID Spoofing:Access Token Manipulation Token Impersonation/Theft:Access Token Manipulation Make and Impersonate Token:Access Token Manipulation Domain Account:Account Discovery DNS:Application Layer Protocol Web Protocols:Application Layer Protocol File Transfer Protocols:Application Layer Protocol BITS Jobs Browser Session Hijacking JavaScript:Command and Scripting Interpreter Visual Basic:Command and Scripting Interpreter PowerShell:Command and Scripting Interpreter Python:Command and Scripting Interpreter Windows Command Shell:Command and Scripting Interpreter Windows Service:Create or Modify System Process Standard Encoding:Data Encoding Data from Local System Protocol or Service Impersonation:Data Obfuscation Data Transfer Size Limits Deobfuscate/Decode Files or Information Asymmetric Cryptography:Encrypted Channel Symmetric Cryptography:Encrypted Channel Exploitation for Client Execution Exploitation for Privilege Escalation File and Directory Discovery Process Argument Spoofing:Hide Artifacts Disable or Modify Tools:Impair Defenses Timestomp:Indicator Removal Ingress Tool Transfer Keylogging:Input Capture Modify Registry Native API Network Service Discovery Network Share Discovery Non-Application Layer Protocol Indicator Removal from Tools:Obfuscated Files or Information Obfuscated Files or Information Office Template Macros:Office Application Startup LSASS Memory:OS Credential Dumping Security Account Manager:OS Credential Dumping Domain Groups:Permission Groups Discovery Local Groups:Permission Groups Discovery Process Discovery Dynamic-link Library Injection:Process Injection Process Hollowing:Process Injection Process Injection Protocol Tunneling Domain Fronting:Proxy Internal Proxy:Proxy Query Registry Reflective Code Loading Remote Desktop Protocol:Remote Services SSH:Remote Services Windows Remote Management:Remote Services SMB/Windows Admin Shares:Remote Services Distributed Component Object Model:Remote Services Remote System Discovery Scheduled Transfer Screen Capture Software Discovery Code Signing:Subvert Trust Controls Rundll32:System Binary Proxy Execution System Network Configuration Discovery System Network Connections Discovery System Service Discovery Service Execution:System Services Pass the Hash:Use Alternate Authentication Material Domain Accounts:Valid Accounts Local Accounts:Valid Accounts Windows Management Instrumentation
S0050 CosmicDuke 723 Web Protocols:Application Layer Protocol Automated Exfiltration Clipboard Data Windows Service:Create or Modify System Process Credentials from Password Stores Credentials from Web Browsers:Credentials from Password Stores Data from Local System Data from Network Shared Drive Data from Removable Media Local Email Collection:Email Collection Symmetric Cryptography:Encrypted Channel Exfiltration Over Unencrypted Non-C2 Protocol:Exfiltration Over Alternative Protocol Exploitation for Privilege Escalation File and Directory Discovery Keylogging:Input Capture LSA Secrets:OS Credential Dumping Security Account Manager:OS Credential Dumping Scheduled Task:Scheduled Task/Job Screen Capture
S0046 CozyCar 723 Web Protocols:Application Layer Protocol Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Windows Command Shell:Command and Scripting Interpreter Windows Service:Create or Modify System Process Rename Legitimate Utilities:Masquerading Encrypted/Encoded File:Obfuscated Files or Information LSASS Memory:OS Credential Dumping Security Account Manager:OS Credential Dumping Scheduled Task:Scheduled Task/Job Security Software Discovery:Software Discovery Rundll32:System Binary Proxy Execution System Information Discovery Virtualization/Sandbox Evasion Bidirectional Communication:Web Service
S0634 EnvyScout 16 JavaScript:Command and Scripting Interpreter Windows Command Shell:Command and Scripting Interpreter Data from Local System Deobfuscate/Decode Files or Information Execution Guardrails Forced Authentication Hidden Files and Directories:Hide Artifacts Masquerading Encrypted/Encoded File:Obfuscated Files or Information HTML Smuggling:Obfuscated Files or Information Spearphishing Attachment:Phishing Rundll32:System Binary Proxy Execution System Information Discovery Malicious File:User Execution
S0512 FatDuke 823 Web Protocols:Application Layer Protocol Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution PowerShell:Command and Scripting Interpreter Data from Local System Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Fallback Channels File and Directory Discovery File Deletion:Indicator Removal Browser Fingerprint:Masquerading Native API Software Packing:Obfuscated Files or Information Obfuscated Files or Information Junk Code Insertion:Obfuscated Files or Information Process Discovery Internal Proxy:Proxy Query Registry Rundll32:System Binary Proxy Execution System Information Discovery System Network Configuration Discovery Time Based Checks:Virtualization/Sandbox Evasion
S0661 FoggyWeb 58 Web Protocols:Application Layer Protocol Archive via Custom Method:Archive Collected Data Archive via Library:Archive Collected Data Data from Local System Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel File and Directory Discovery DLL:Hijack Execution Flow Ingress Tool Transfer Masquerading Match Legitimate Resource Name or Location:Masquerading Native API Network Sniffing Compile After Delivery:Obfuscated Files or Information Encrypted/Encoded File:Obfuscated Files or Information Process Discovery Reflective Code Loading Shared Modules Private Keys:Unsecured Credentials Use Alternate Authentication Material
S0049 GeminiDuke 7 Local Account:Account Discovery Web Protocols:Application Layer Protocol File and Directory Discovery Process Discovery System Network Configuration Discovery System Service Discovery
S0597 GoldFinder 17191624 Web Protocols:Application Layer Protocol Automated Collection Internet Connection Discovery:System Network Configuration Discovery
S0588 GoldMax 1719141624 Web Protocols:Application Layer Protocol Windows Command Shell:Command and Scripting Interpreter Junk Data:Data Obfuscation Deobfuscate/Decode Files or Information Asymmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel Ignore Process Interrupts:Hide Artifacts Ingress Tool Transfer Match Legitimate Resource Name or Location:Masquerading Masquerade Task or Service:Masquerading Software Packing:Obfuscated Files or Information Encrypted/Encoded File:Obfuscated Files or Information Scheduled Task:Scheduled Task/Job Cron:Scheduled Task/Job System Network Configuration Discovery System Time Discovery Time Based Checks:Virtualization/Sandbox Evasion System Checks:Virtualization/Sandbox Evasion
S0037 HAMMERTOSS 723 Web Protocols:Application Layer Protocol PowerShell:Command and Scripting Interpreter Steganography:Data Obfuscation Symmetric Cryptography:Encrypted Channel Exfiltration to Cloud Storage:Exfiltration Over Web Service Hidden Window:Hide Artifacts One-Way Communication:Web Service
S0357 Impacket 11 LLMNR/NBT-NS Poisoning and SMB Relay:Adversary-in-the-Middle Lateral Tool Transfer Network Sniffing NTDS:OS Credential Dumping LSASS Memory:OS Credential Dumping Security Account Manager:OS Credential Dumping LSA Secrets:OS Credential Dumping Kerberoasting:Steal or Forge Kerberos Tickets Ccache Files:Steal or Forge Kerberos Tickets Service Execution:System Services Windows Management Instrumentation
S0100 ipconfig 55 System Network Configuration Discovery
S0513 LiteDuke 823 Web Protocols:Application Layer Protocol Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Deobfuscate/Decode Files or Information File Deletion:Indicator Removal Ingress Tool Transfer Steganography:Obfuscated Files or Information Software Packing:Obfuscated Files or Information Query Registry Security Software Discovery:Software Discovery System Information Discovery System Network Configuration Discovery System Owner/User Discovery Time Based Checks:Virtualization/Sandbox Evasion
S0175 meek 32 Domain Fronting:Proxy
S0002 Mimikatz 7474 SID-History Injection:Access Token Manipulation Account Manipulation Security Support Provider:Boot or Logon Autostart Execution Credentials from Password Stores Credentials from Web Browsers:Credentials from Password Stores Windows Credential Manager:Credentials from Password Stores DCSync:OS Credential Dumping Security Account Manager:OS Credential Dumping LSASS Memory:OS Credential Dumping LSA Secrets:OS Credential Dumping Rogue Domain Controller Steal or Forge Authentication Certificates Golden Ticket:Steal or Forge Kerberos Tickets Silver Ticket:Steal or Forge Kerberos Tickets Private Keys:Unsecured Credentials Pass the Hash:Use Alternate Authentication Material Pass the Ticket:Use Alternate Authentication Material
S0051 MiniDuke 7823 Web Protocols:Application Layer Protocol Domain Generation Algorithms:Dynamic Resolution Fallback Channels File and Directory Discovery Ingress Tool Transfer Obfuscated Files or Information Internal Proxy:Proxy System Information Discovery Dead Drop Resolver:Web Service
S0637 NativeZone 10 Deobfuscate/Decode Files or Information Execution Guardrails Masquerading Rundll32:System Binary Proxy Execution Malicious File:User Execution System Checks:Virtualization/Sandbox Evasion
S0039 Net 55 Domain Account:Account Discovery Local Account:Account Discovery Additional Local or Domain Groups:Account Manipulation Local Account:Create Account Domain Account:Create Account Network Share Connection Removal:Indicator Removal Network Share Discovery Password Policy Discovery Domain Groups:Permission Groups Discovery Local Groups:Permission Groups Discovery SMB/Windows Admin Shares:Remote Services Remote System Discovery System Network Connections Discovery System Service Discovery Service Execution:System Services System Time Discovery
S0052 OnionDuke 7823 Web Protocols:Application Layer Protocol Deobfuscate/Decode Files or Information Endpoint Denial of Service OS Credential Dumping One-Way Communication:Web Service
S0048 PinchDuke 7 Web Protocols:Application Layer Protocol Credentials from Password Stores Credentials from Web Browsers:Credentials from Password Stores Data from Local System File and Directory Discovery OS Credential Dumping System Information Discovery
S0518 PolyglotDuke 823 Web Protocols:Application Layer Protocol Deobfuscate/Decode Files or Information Ingress Tool Transfer Modify Registry Native API Obfuscated Files or Information Fileless Storage:Obfuscated Files or Information Steganography:Obfuscated Files or Information Rundll32:System Binary Proxy Execution Dead Drop Resolver:Web Service
S0150 POSHSPY 57 PowerShell:Command and Scripting Interpreter Data Transfer Size Limits Domain Generation Algorithms:Dynamic Resolution Asymmetric Cryptography:Encrypted Channel Windows Management Instrumentation Event Subscription:Event Triggered Execution Timestomp:Indicator Removal Ingress Tool Transfer Obfuscated Files or Information
S0139 PowerDuke 59 Application Window Discovery Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Windows Command Shell:Command and Scripting Interpreter Data Destruction File and Directory Discovery NTFS File Attributes:Hide Artifacts File Deletion:Indicator Removal Ingress Tool Transfer Steganography:Obfuscated Files or Information Process Discovery Rundll32:System Binary Proxy Execution System Information Discovery System Network Configuration Discovery System Owner/User Discovery System Time Discovery
S0029 PsExec 78 Domain Account:Create Account Windows Service:Create or Modify System Process Lateral Tool Transfer SMB/Windows Admin Shares:Remote Services Service Execution:System Services
S1084 QUIETEXIT 11 Application Layer Protocol Fallback Channels Match Legitimate Resource Name or Location:Masquerading Non-Application Layer Protocol External Proxy:Proxy
S0565 Raindrop 451624 Deobfuscate/Decode Files or Information Masquerading Match Legitimate Resource Name or Location:Masquerading Encrypted/Encoded File:Obfuscated Files or Information Software Packing:Obfuscated Files or Information Steganography:Obfuscated Files or Information Time Based Checks:Virtualization/Sandbox Evasion
S0511 RegDuke 823 PowerShell:Command and Scripting Interpreter Deobfuscate/Decode Files or Information Windows Management Instrumentation Event Subscription:Event Triggered Execution Ingress Tool Transfer Modify Registry Steganography:Obfuscated Files or Information Fileless Storage:Obfuscated Files or Information Obfuscated Files or Information Bidirectional Communication:Web Service
S1187 reGeorg 11 Web Protocols:Application Layer Protocol Python:Command and Scripting Interpreter Ingress Tool Transfer Non-Application Layer Protocol Protocol Tunneling Proxy Remote Desktop Protocol:Remote Services SSH:Remote Services SMB/Windows Admin Shares:Remote Services Web Shell:Server Software Component
S0684 ROADTools 34 Cloud Account:Account Discovery Automated Collection Cloud Service Discovery Cloud Groups:Permission Groups Discovery Remote System Discovery Cloud Accounts:Valid Accounts
S0195 SDelete 32 Data Destruction File Deletion:Indicator Removal
S0053 SeaDuke 72339 Web Protocols:Application Layer Protocol Archive via Library:Archive Collected Data Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Shortcut Modification:Boot or Logon Autostart Execution Windows Command Shell:Command and Scripting Interpreter PowerShell:Command and Scripting Interpreter Standard Encoding:Data Encoding Remote Email Collection:Email Collection Symmetric Cryptography:Encrypted Channel Windows Management Instrumentation Event Subscription:Event Triggered Execution File Deletion:Indicator Removal Ingress Tool Transfer Software Packing:Obfuscated Files or Information Pass the Ticket:Use Alternate Authentication Material Valid Accounts
S0589 Sibot 17191624 Web Protocols:Application Layer Protocol Visual Basic:Command and Scripting Interpreter Deobfuscate/Decode Files or Information File Deletion:Indicator Removal Indicator Removal Ingress Tool Transfer Match Legitimate Resource Name or Location:Masquerading Modify Registry Command Obfuscation:Obfuscated Files or Information Fileless Storage:Obfuscated Files or Information Query Registry Scheduled Task:Scheduled Task/Job Mshta:System Binary Proxy Execution Rundll32:System Binary Proxy Execution System Network Configuration Discovery System Network Connections Discovery Web Service Windows Management Instrumentation
S0633 Sliver 1923 Bypass User Account Control:Abuse Elevation Control Mechanism Access Token Manipulation DNS:Application Layer Protocol Web Protocols:Application Layer Protocol Application Layer Protocol PowerShell:Command and Scripting Interpreter Standard Encoding:Data Encoding Steganography:Data Obfuscation Asymmetric Cryptography:Encrypted Channel Symmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel File and Directory Discovery Ingress Tool Transfer Obfuscated Files or Information Compile After Delivery:Obfuscated Files or Information Encrypted/Encoded File:Obfuscated Files or Information LSASS Memory:OS Credential Dumping Process Injection Internal Proxy:Proxy Screen Capture Golden Ticket:Steal or Forge Kerberos Tickets System Network Configuration Discovery System Network Connections Discovery
S0516 SoreFang 1855 Domain Account:Account Discovery Local Account:Account Discovery Web Protocols:Application Layer Protocol Deobfuscate/Decode Files or Information Exploit Public-Facing Application File and Directory Discovery Ingress Tool Transfer Local Storage Discovery Obfuscated Files or Information Domain Groups:Permission Groups Discovery Process Discovery Scheduled Task:Scheduled Task/Job System Information Discovery System Network Configuration Discovery
S0559 SUNBURST 91424 DNS:Application Layer Protocol Web Protocols:Application Layer Protocol Visual Basic:Command and Scripting Interpreter Standard Encoding:Data Encoding Data from Local System Protocol or Service Impersonation:Data Obfuscation Junk Data:Data Obfuscation Steganography:Data Obfuscation Dynamic Resolution Symmetric Cryptography:Encrypted Channel Image File Execution Options Injection:Event Triggered Execution File and Directory Discovery Disable or Modify Tools:Impair Defenses Clear Persistence:Indicator Removal File Deletion:Indicator Removal Clear Network Connection History and Configurations:Indicator Removal Indicator Removal Ingress Tool Transfer Match Legitimate Resource Name or Location:Masquerading Modify Registry Obfuscated Files or Information Compression:Obfuscated Files or Information Indicator Removal from Tools:Obfuscated Files or Information Process Discovery Query Registry Security Software Discovery:Software Discovery Code Signing:Subvert Trust Controls Rundll32:System Binary Proxy Execution System Information Discovery System Network Configuration Discovery System Owner/User Discovery System Service Discovery System Time Discovery Time Based Checks:Virtualization/Sandbox Evasion System Checks:Virtualization/Sandbox Evasion Windows Management Instrumentation
S0562 SUNSPOT 316 Access Token Manipulation Stored Data Manipulation:Data Manipulation Deobfuscate/Decode Files or Information Execution Guardrails Mutual Exclusion:Execution Guardrails File and Directory Discovery File Deletion:Indicator Removal Match Legitimate Resource Name or Location:Masquerading Native API Obfuscated Files or Information Process Discovery Compromise Software Supply Chain:Supply Chain Compromise
S0096 Systeminfo 55 System Information Discovery
S0057 Tasklist 55 Process Discovery Security Software Discovery:Software Discovery System Service Discovery
S0560 TEARDROP 9141624 Windows Service:Create or Modify System Process Deobfuscate/Decode Files or Information Match Legitimate Resource Name or Location:Masquerading Modify Registry Obfuscated Files or Information Query Registry
S0183 Tor 32 Asymmetric Cryptography:Encrypted Channel Multi-hop Proxy:Proxy
S0682 TrailBlazer 4 Web Protocols:Application Layer Protocol Junk Data:Data Obfuscation Data Obfuscation Windows Management Instrumentation Event Subscription:Event Triggered Execution Masquerading
S0636 VaporRage 16 Web Protocols:Application Layer Protocol Deobfuscate/Decode Files or Information Execution Guardrails Ingress Tool Transfer
S0515 WellMail 561819 Archive Collected Data Data from Local System Deobfuscate/Decode Files or Information Asymmetric Cryptography:Encrypted Channel Ingress Tool Transfer Non-Application Layer Protocol Non-Standard Port System Network Configuration Discovery System Owner/User Discovery
S0514 WellMess 2221601819 DNS:Application Layer Protocol Web Protocols:Application Layer Protocol PowerShell:Command and Scripting Interpreter Windows Command Shell:Command and Scripting Interpreter Standard Encoding:Data Encoding Data from Local System Junk Data:Data Obfuscation Deobfuscate/Decode Files or Information Asymmetric Cryptography:Encrypted Channel Symmetric Cryptography:Encrypted Channel Ingress Tool Transfer Domain Groups:Permission Groups Discovery System Information Discovery System Network Configuration Discovery System Owner/User Discovery

References

  1. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. ↩↩↩

  2. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  3. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. ↩↩

  4. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  5. Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE – Russian Malicious Cyber Activity. Retrieved January 11, 2017. ↩

  6. Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018. ↩

  7. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  8. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. ↩↩↩↩↩↩↩↩↩↩↩↩↩

  9. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩↩↩↩↩↩↩↩

  10. Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021. ↩↩↩↩↩

  11. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  12. Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. ↩

  13. Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019. ↩

  14. Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021. ↩↩↩↩↩↩↩↩↩↩↩

  15. MSRC. (2021, June 25). New Nobelium activity. Retrieved August 4, 2021. ↩↩

  16. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩↩↩↩↩↩↩↩↩↩↩↩↩

  17. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021. ↩↩↩↩↩↩↩

  18. National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020. ↩↩↩↩↩↩↩

  19. NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  20. NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021. ↩

  21. PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020. ↩↩↩

  22. PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020. ↩↩↩↩

  23. Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  24. Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. ↩↩↩↩↩↩↩↩↩↩↩↩

  25. UK Gov. (2021, April 15). UK and US expose global campaign of malign activity by Russian intelligence services . Retrieved April 16, 2021. ↩

  26. UK Gov. (2021, April 15). UK exposes Russian involvement in SolarWinds cyber compromise . Retrieved April 16, 2021. ↩

  27. UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021. ↩

  28. Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023. ↩↩

  29. White House. (2021, April 15). Imposing Costs for Harmful Foreign Activities by the Russian Government. Retrieved April 16, 2021. ↩

  30. Luke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock. (2021, December 6). Suspected Russian Activity Targeting Government and Business Entities Around the Globe. Retrieved April 15, 2022. ↩

  31. UK National Cyber Security Center et al. (2024, February). SVR cyber actors adapt tactics for initial cloud access. Retrieved March 1, 2024. ↩↩↩↩↩↩↩

  32. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved September 12, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  33. ESET. (2022, February). THREAT REPORT T3 2021. Retrieved February 10, 2022. ↩↩↩↩↩↩↩↩↩↩

  34. Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022. ↩↩↩↩↩↩↩↩

  35. Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023. ↩↩↩↩↩↩↩↩↩↩↩

  36. FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved November 17, 2024. ↩

  37. Secureworks CTU. (2021, May 28). USAID-Themed Phishing Campaign Leverages U.S. Elections Lure. Retrieved February 24, 2022. ↩↩↩

  38. Microsoft Threat Intelligence Center, Microsoft Detection and Response Team, Microsoft 365 Defender Research Team . (2022, August 24). MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone. Retrieved September 28, 2022. ↩

  39. Symantec Security Response. (2015, July 13). “Forkmeiamfamous”: Seaduke, latest weapon in the Duke armory. Retrieved July 22, 2015. ↩↩↩

  40. Mandiant. (2022, August). Remediation and Hardening Strategies for Microsoft 365 to Defend Against APT29. Retrieved February 21, 2023. ↩

  41. Wolfram, J. et al. (2022, April 28). Trello From the Other Side: Tracking APT29 Phishing Campaigns. Retrieved August 3, 2022. ↩

  42. Dunwoody, M. (2017, March 27). APT29 Domain Fronting With TOR. Retrieved March 27, 2017. ↩

  43. ANSSI. (2021, December 6). PHISHING CAMPAIGNS BY THE NOBELIUM INTRUSION SET. Retrieved April 13, 2022. ↩

  44. MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 30, 2020. ↩↩↩

  45. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021. ↩↩↩↩

  46. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩↩↩↩↩↩↩↩↩↩↩↩↩

  47. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021. ↩↩↩↩↩

  48. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021. ↩↩

  49. MSRC Team. (2021, February 18). Microsoft Internal Solorigate Investigation – Final Update. Retrieved May 14, 2021. ↩

  50. Sudhakar Ramakrishna . (2021, January 11). New Findings From Our Investigation of SUNBURST. Retrieved January 13, 2021. ↩

  51. Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021. ↩

  52. FBI, CISA, ODNI, NSA. (2022, January 5). Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA). Retrieved March 26, 2023. ↩

  53. Mandiant. (2022, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023. ↩

  54. SolarWinds. (2020, December 24). SolarWinds Security Advisory. Retrieved February 22, 2021. ↩

  55. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. ↩↩↩↩↩

  56. CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020. ↩

  57. Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017. ↩

  58. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. ↩

  59. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017. ↩

  60. CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020. ↩