threat actor

APT29

activeentity:threat_actor

[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee star

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: apt29
kind: threat actor
status: active
aliases: Blue Kitsune · Cozy Bear · CozyDuke · Dark Halo · IRON HEMLOCK · IRON RITUAL · Midnight Blizzard · NOBELIUM · NobleBaron · SolarStorm · The Dukes · UNC2452 · UNC3524 · YTTRIUM
jurisdictions: —
claims naming it: 0 · 0 attributions · 34 relations · 0 events

Identifiers

attack G0016via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatAPT29usesPinchDuke
fetch —sha256 dc1639caa5501d72
rel_384btcintel:relations:384@v1 sha256:5caf6fb58ce281a8
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesWellMail
fetch —sha256 dc1639caa5501d72
rel_385btcintel:relations:385@v1 sha256:193208a5bad5ba6b
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesCozyCar
fetch —sha256 dc1639caa5501d72
rel_386btcintel:relations:386@v1 sha256:8500b67b10dd3c01
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesTrailBlazer
fetch —sha256 dc1639caa5501d72
rel_387btcintel:relations:387@v1 sha256:ddbe3dcd518bce7a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesOnionDuke
fetch —sha256 dc1639caa5501d72
rel_388btcintel:relations:388@v1 sha256:c11997148579fa79
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesFatDuke
fetch —sha256 dc1639caa5501d72
rel_389btcintel:relations:389@v1 sha256:a6ac631deea13cc1
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesPOSHSPY
fetch —sha256 dc1639caa5501d72
rel_390btcintel:relations:390@v1 sha256:a77f6a1eb483166c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesEnvyScout
fetch —sha256 dc1639caa5501d72
rel_391btcintel:relations:391@v1 sha256:dd254c51fce2c117
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesSoreFang
fetch —sha256 dc1639caa5501d72
rel_392btcintel:relations:392@v1 sha256:3eb9936a7e2dc7ef
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesGeminiDuke
fetch —sha256 dc1639caa5501d72
rel_393btcintel:relations:393@v1 sha256:e2d7585ec9bebf6a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesreGeorg
fetch —sha256 dc1639caa5501d72
rel_394btcintel:relations:394@v1 sha256:c82063c68a227a44
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesGoldMax
fetch —sha256 dc1639caa5501d72
rel_395btcintel:relations:395@v1 sha256:a013d516f6e72a0d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesFoggyWeb
fetch —sha256 dc1639caa5501d72
rel_396btcintel:relations:396@v1 sha256:b3571958915282d7
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesPolyglotDuke
fetch —sha256 dc1639caa5501d72
rel_397btcintel:relations:397@v1 sha256:23cd1b0701717544
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesMiniDuke
fetch —sha256 dc1639caa5501d72
rel_398btcintel:relations:398@v1 sha256:a1eaba49c6e711fe
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesTEARDROP
fetch —sha256 dc1639caa5501d72
rel_399btcintel:relations:399@v1 sha256:a31105038cc35293
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesSeaDuke
fetch —sha256 dc1639caa5501d72
rel_400btcintel:relations:400@v1 sha256:e0430d5d1830aecb
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesSibot
fetch —sha256 dc1639caa5501d72
rel_401btcintel:relations:401@v1 sha256:83fb10613664492c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesRaindrop
fetch —sha256 dc1639caa5501d72
rel_402btcintel:relations:402@v1 sha256:aec840e47a78884f
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesRegDuke
fetch —sha256 dc1639caa5501d72
rel_403btcintel:relations:403@v1 sha256:2700fb939e4805a0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesCloudDuke
fetch —sha256 dc1639caa5501d72
rel_404btcintel:relations:404@v1 sha256:b888f5722ba60613
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesGoldFinder
fetch —sha256 dc1639caa5501d72
rel_405btcintel:relations:405@v1 sha256:b47569a1c2e4553d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesNativeZone
fetch —sha256 dc1639caa5501d72
rel_406btcintel:relations:406@v1 sha256:d403d9ece9a44ae9
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesSUNSPOT
fetch —sha256 dc1639caa5501d72
rel_407btcintel:relations:407@v1 sha256:7453a032027a2e81
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_408btcintel:relations:408@v1 sha256:a7f2de86f6a35554
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesPowerDuke
fetch —sha256 dc1639caa5501d72
rel_409btcintel:relations:409@v1 sha256:bb235d2546fbb114
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesQUIETEXIT
fetch —sha256 dc1639caa5501d72
rel_410btcintel:relations:410@v1 sha256:326177e972200b18
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesHAMMERTOSS
fetch —sha256 dc1639caa5501d72
rel_411btcintel:relations:411@v1 sha256:698d4470d1bed3c1
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesBoomBox
fetch —sha256 dc1639caa5501d72
rel_412btcintel:relations:412@v1 sha256:7d2cbcc825cfc39e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesCosmicDuke
fetch —sha256 dc1639caa5501d72
rel_413btcintel:relations:413@v1 sha256:bba63096dce9de33
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesSUNBURST
fetch —sha256 dc1639caa5501d72
rel_414btcintel:relations:414@v1 sha256:74e5326a00d02acf
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesWellMess
fetch —sha256 dc1639caa5501d72
rel_415btcintel:relations:415@v1 sha256:a255727c054ba028
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesVaporRage
fetch —sha256 dc1639caa5501d72
rel_416btcintel:relations:416@v1 sha256:fcaaa1e69eb5603d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesLiteDuke
fetch —sha256 dc1639caa5501d72
rel_417btcintel:relations:417@v1 sha256:761f200136481c94
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.