Threat Actors APT29

APT29

G0016 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Dukes, Group 100, Cozy Duke, EuroAPT, Cozy Bear, CozyCar, Cozer, Office Monkeys / TEMP.Monkeys, Minidionis, SeaDuke, Hammer Toss, Fritillary, IRON HEMLOCK, The Dukes, YTTRIUM, Grizzly Steppe, G0016, ATK7, Cloaked Ursa, TA421, Blue Kitsune, ITG11, BlueBravo, Nobelium, UAC-0029, DarkHalo, StellarParticle, Solar Phoenix, Midnight Blizzard, ICECAP, ICE RELIC, IRON RITUAL, NobleBaron, Dark Halo, UNC2452, CozyDuke, SolarStorm, UNC3524, techniques, vaccine espionage, tracked as, CozyBear, ROOTSAW, VaporRage by Microsoft

Description

**Targets:** This threat actor targets government ministries and agencies in Europe, the US, Central Asia, East Africa, and the Middle East, associated with DNC attacks **Toolset/Malware:** Hammertoss, OnionDuke, CosmicDuke, MiniDuke, CozyDuke, SeaDuke, SeaDaddy implant developed in Python and compiled with py2exe, AdobeARM, ATI-Agent, MiniDionis, Grizzly Steppe, Vernaldrop, Tadpole, Spikerush, POSHSPY, PolyglotDuke, RegDuke, FatDuke **Modus Operandi:** Phishing emails **Operations:** Operation Ghost **Notes:** Active campaign post 2016 US presidential election

TTP Summary

Phishing emails

Goals & Targeting

Targeted Sectors

Government

Think tank

Defense

Non profit

Energy

Healthcare

Telecommunications

Media

Pharmaceutical

Education

Aviation

Maritime

Aerospace

Financial services

Transportation

Utilities

Targeted Countries / Regions

middle_east

europe

central_asia

AI Analysis

· 1 week ago

Executive Summary

APT29, also known as Dukes, Group 100, and Cozy Bear, is a nation-state threat actor primarily involved in espionage activities targeting government ministries and agencies across Europe, the US, Central Asia, East Africa, and the Middle East. Known for their sophisticated phishing campaigns, APT29 has been linked to operations such as Operation Ghost, which gained attention post the 2016 US presidential election.

Goals & Targeting

APT29's strategic objectives revolve around情报 and political gathering through cyber espionage. They specifically target government sectors due to the sensitivity of the information held, with a focus on diplomatic offices and ministries in Europe, Central Asia, and the Middle East. Their targeting reflects a desire to influence geopolitical dynamics by compromising sensitive data.

Enhanced Description

APT29 is a high-sophistication nation-state actor known for targeting government entities to gather political and economic intelligence. They primarily use phishing emails as their attack vector, leveraging malware like CozyDuke, MiniDuke, and others. Their operations often involve credential theft and persistence mechanisms using tools such as PowerDuke and Cobalt Strike. APT29's campaigns are characterized by their patient and targeted approach, aiming to infiltrate sensitive systems for long-term espionage activities.

Key Capabilities

CozyDuke
MiniDuke
SeaDuke
Hammertoss
CosmicDuke
OnionDuke
PowerDuke
Cobalt Strike

MITRE ATT&CK Tactics

Credential Access

Initial Access

Execution

Lateral Movement

Collection

Exfiltration

Impact

ATT&CK Techniques

T1053.005

T1037

T1566.003

T1110.001

T1394

T1016.001

T1003.002

T1036.005

Software / Tooling

PowerDuke

OnionDuke

Hammertoss

CosmicDuke

ReGeorg

Cobalt Strike

Campaigns & Victims

APT29's operations include campaigns like Operation Ghost, which targeted US government and political organizations post the 2016 election. Their modus operandi typically involves phishing emails with malware payloads to gain unauthorized access to systems, followed by lateral movement and data exfiltration. APT29 is known for maintaining long-term persistence within networks to gather extensive intelligence over time.

IOC Patterns

Spear-phishing email campaigns
Malware distribution via Office documents
Scheduled task creation
Registry modification for persistence

Recommended Actions

Implement multi-layered email filtering to detect phishing attempts.
Monitor for known APT29-related IOC patterns in network traffic.
Enhance endpoint detection and response capabilities.
Regularly update software and patch vulnerabilities to mitigate exploitation.

Suggested Tags

APT

Government Targeting

Espionage

Nation-State

Confidence Assessment

Confidence in APT29's activities is high due to extensive evidence from tracked campaigns and technical details. However, gaps exist in fully understanding their exact methods and long-term objectives.

ATT&CK Techniques

Collection

5 techniques

T1005

Data from Local System

APT29 has stolen data from compromised hosts.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1074

Data Staged

T1114.002

Remote Email Collection

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.(Citation: Mandiant APT29 Microsoft 365 2022)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1213

Data from Information Repositories

T1560

Archive Collected Data

Command & Control

11 techniques

T1001

Data Obfuscation

T1071

Application Layer Protocol

T1090

Proxy

T1090.002

External Proxy

APT29 uses compromised residential endpoints as proxies for defense evasion and network access.(Citation: NCSC et al APT29 2024)

T1090.003

Multi-hop Proxy

A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Oct 2021)

T1090.004

Domain Fronting

APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.(Citation: Mandiant No Easy Breach)

T1102

Web Service

T1105

Ingress Tool Transfer

APT29 has downloaded additional tools and malware onto compromised networks.(Citation: Mandiant No Easy Breach)(Citation: PWC WellMess July 2020)(Citation: F-Secure The Dukes)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1568

Dynamic Resolution

APT29 has used Dynamic DNS providers for their malware C2 infrastructure.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1573

Encrypted Channel

APT29 has used multiple layers of encryption within malware to protect C2 communication.(Citation: Secureworks IRON HEMLOCK Profile)

T1665

Hide Infrastructure

APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.(Citation: NCSC et al APT29 2024)

Credential Access

10 techniques

T1003.002

Security Account Manager

APT29 has used the `reg save` command to save registry hives.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1003.004

LSA Secrets

APT29 has used the `reg save` command to extract LSA secrets offline.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1110

Brute Force

T1110.001

Password Guessing

APT29 has successfully conducted password guessing attacks against a list of mailboxes.(Citation: Mandiant APT29 Microsoft 365 2022)

T1110.003

Password Spraying

APT29 has conducted brute force password spray attacks.(Citation: MSRC Nobelium June 2021)(Citation: MSTIC Nobelium Oct 2021)(Citation: NCSC et al APT29 2024)

T1528

Steal Application Access Token

APT29 uses stolen tokens to access victim accounts, without needing a password.(Citation: NCSC et al APT29 2024)

T1555

Credentials from Password Stores

T1558

Steal or Forge Kerberos Tickets

T1621

Multi-Factor Authentication Request Generation

APT29 has used repeated MFA requests to gain access to victim accounts.(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)(Citation: NCSC et al APT29 2024)

T1649

Steal or Forge Authentication Certificates

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.(Citation: Mandiant APT29 Trello)

Defense impairment

3 techniques

T1553.005

Mark-of-the-Web Bypass

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.(Citation: ESET T3 Threat Report 2021)

T1556.007

Hybrid Identity

APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.(Citation: MagicWeb)

T1685.002

Disable or Modify Cloud Log

APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.(Citation: Mandiant APT29 Microsoft 365 2022)

Discovery

8 techniques

T1016

System Network Configuration Discovery

T1016.001

Internet Connection Discovery

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1057

Process Discovery

T1069

Permission Groups Discovery

T1083

File and Directory Discovery

T1087

Account Discovery

T1087.004

Cloud Account

APT29 has conducted enumeration of Azure AD accounts.(Citation: MSTIC Nobelium Oct 2021)

T1482

Domain Trust Discovery

Execution

11 techniques

T1047

Windows Management Instrumentation

APT29 used WMI to steal credentials and execute backdoors at a future time.(Citation: Mandiant No Easy Breach)

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

APT29 has used named and hijacked scheduled tasks to establish persistence.(Citation: Mandiant No Easy Breach)

T1059

Command and Scripting Interpreter

T1059.001

PowerShell

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.(Citation: Symantec Seaduke 2015)(Citation: Mandiant No Easy Breach)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)

T1059.006

Python

APT29 has developed malware variants written in Python.(Citation: Symantec Seaduke 2015)

T1059.009

Cloud API

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API (Citation: MSTIC Nobelium Toolset May 2021)

T1203

Exploitation for Client Execution

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.(Citation: F-Secure The Dukes)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: MSTIC NOBELIUM May 2021)

T1204.001

Malicious Link

APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.(Citation: MSTIC NOBELIUM May 2021)(Citation: Secureworks IRON RITUAL USAID Phish May 2021)

T1204.002

Malicious File

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. (Citation: F-Secure The Dukes)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)

T1651

Cloud Administration Command

APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.(Citation: MSTIC Nobelium Oct 2021)

Initial Access

6 techniques

T1190

Exploit Public-Facing Application

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: NCSC APT29 July 2020)

T1199

Trusted Relationship

APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.(Citation: MSTIC Nobelium Oct 2021)

T1566

Phishing

T1566.001

Spearphishing Attachment

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.(Citation: F-Secure The Dukes)(Citation: MSTIC NOBELIUM May 2021)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)

T1566.002

Spearphishing Link

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.(Citation: Mandiant No Easy Breach)(Citation: MSTIC NOBELIUM May 2021)(Citation: Secureworks IRON RITUAL USAID Phish May 2021)

T1566.003

Spearphishing via Service

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.(Citation: MSTIC NOBELIUM May 2021)

Lateral Movement

2 techniques

T1021.007

Cloud Services

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.(Citation: Mandiant Remediation and Hardening Strategies for Microsoft 365)

T1550.003

Pass the Ticket

APT29 used Kerberos ticket attacks for lateral movement.(Citation: Mandiant No Easy Breach)

Persistence

11 techniques

T1037

Boot or Logon Initialization Scripts

APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1037.004

RC Scripts

APT29 has installed a run command on a compromised system to enable malware execution on system startup.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1098

Account Manipulation

T1098.002

Additional Email Delegate Permissions

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.(Citation: Mandiant APT29 Microsoft 365 2022)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1098.005

Device Registration

APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.(Citation: Mandiant APT29 Microsoft 365 2022)(Citation: NCSC et al APT29 2024)

T1133

External Remote Services

APT29 has used compromised identities to access networks via VPNs and Citrix.(Citation: NCSC APT29 July 2020)(Citation: Mandiant APT29 Microsoft 365 2022)

T1136

Create Account

T1136.003

Cloud Account

APT29 can create new users through Azure AD.(Citation: MSTIC Nobelium Oct 2021)

T1505.003

Web Shell

APT29 has installed web shells on exploited Microsoft Exchange servers.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

APT29 added Registry Run keys to establish persistence.(Citation: Mandiant No Easy Breach)

Privilege Escalation

5 techniques

T1068

Exploitation for Privilege Escalation

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.(Citation: ESET T3 Threat Report 2021)

T1546.003

Windows Management Instrumentation Event Subscription

APT29 has used WMI event subscriptions for persistence.(Citation: Mandiant No Easy Breach)

T1546.008

Accessibility Features

APT29 used sticky-keys to obtain unauthenticated, privileged console access.(Citation: Mandiant No Easy Breach)(Citation: FireEye APT29 Domain Fronting)

T1548

Abuse Elevation Control Mechanism

T1548.002

Bypass User Account Control

APT29 has bypassed UAC.(Citation: Mandiant No Easy Breach)

Reconnaissance

2 techniques

T1595

Active Scanning

T1595.002

Vulnerability Scanning

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.(Citation: Cybersecurity Advisory SVR TTP May 2021)

Resource Development

10 techniques

T1583

Acquire Infrastructure

T1583.006

Web Services

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.(Citation: FireEye APT29)(Citation: MSTIC NOBELIUM May 2021)

T1584

Compromise Infrastructure

T1586

Compromise Accounts

T1586.002

Email Accounts

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.(Citation: ANSSI Nobelium Phishing December 2021)(Citation: Mandiant APT29 Microsoft 365 2022)

T1586.003

Cloud Accounts

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.(Citation: Mandiant APT29 Microsoft 365 2022)

T1587

Develop Capabilities

T1587.001

Malware

APT29 has used unique malware in many of their operations.(Citation: F-Secure The Dukes)(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Toolset May 2021)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1587.003

Digital Certificates

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)

T1588.002

Tool

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.(Citation: Mandiant No Easy Breach)(Citation: F-Secure The Dukes)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

Stealth

13 techniques

T1027

Obfuscated Files or Information

T1027.001

Binary Padding

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.(Citation: SentinelOne NobleBaron June 2021)

T1027.002

Software Packing

APT29 used UPX to pack files.(Citation: Mandiant No Easy Breach)

T1027.006

HTML Smuggling

APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.(Citation: ESET T3 Threat Report 2021)

T1036.005

Match Legitimate Resource Name or Location

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.(Citation: SentinelOne NobleBaron June 2021)(Citation: Mandiant APT29 Microsoft 365 2022)

T1070

Indicator Removal

T1070.004

File Deletion

APT29 has used SDelete to remove artifacts from victim networks.(Citation: Mandiant No Easy Breach)

T1070.006

Timestomp

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1078

Valid Accounts

APT29 has used a compromised account to access an organization's VPN infrastructure.(Citation: Mandiant APT29 Microsoft 365 2022)

T1078.003

Local Accounts

APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.(Citation: NCSC et al APT29 2024)

T1078.004

Cloud Accounts

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.(Citation: Mandiant APT29 Microsoft 365 2022)(Citation: Mandiant APT29 Eye Spy Email Nov 22)

T1140

Deobfuscate/Decode Files or Information

T1218.005

Mshta

APT29 has use `mshta` to execute malicious scripts on a compromised host.(Citation: ESET T3 Threat Report 2021)

Software / Tooling

win.ati_agent

ATI-Agent

APT29

Description

TTP Summary

Goals & Targeting

AI Analysis

ATT&CK Techniques

Software / Tooling

Campaigns / Victims

Observed Data

Indicators of Compromise

References

Intel Summary

Tags

Details