Home/ Threat Actors/ APT29

🇷🇺APT29

🇷🇺 APT29 is a tracked threat actor in the Clankerusecase corpus. Attributed to RU. Primary motivation: State. We map 24 detection use cases to this actor across 104 MITRE ATT&CK techniques, with 7 threat-intel articles citing them. Active in our corpus from 2026-02-26 to 2026-08-10.

crit 6low 1

View full actor card → All threat actors MITRE ATT&CK group spec (G0016) ↗

24Use cases

7Articles

104Techniques

46IOCs

Known aliases

APT29Cozy BearNobeliumMidnight BlizzardThe DukesYTTRIUMSVRIRON RITUALIRON HEMLOCKNobleBaronDark HaloNOBELIUMUNC2452CozyDukeSolarStormBlue KitsuneUNC3524

Top techniques

T1190 · Exploit Public-Facing Application T1059.001 · PowerShell T1204.002 · Malicious File

All other tracked techniques

T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1003.002 · Security Account Manager T1003.003 · NTDS T1003.004 · LSA Secrets T1005 · Data from Local System T1016.001 · Internet Connection Discovery T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.007 · Cloud Services T1027 · Obfuscated Files or Information T1027.001 · Binary Padding T1027.002 · Software Packing T1027.006 · HTML Smuggling T1036.005 · Match Legitimate Resource Name or Location T1037 · Boot or Logon Initialization Scripts T1037.004 · RC Scripts T1047 · Windows Management Instrumentation T1053.005 · Scheduled Task T1057 · Process Discovery T1059 · Command and Scripting Interpreter T1059.003 · Windows Command Shell T1059.005 · Visual Basic T1059.006 · Python T1059.007 · JavaScript T1059.009 · Cloud API T1068 · Exploitation for Privilege Escalation T1070.004 · File Deletion T1070.006 · Timestomp T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1078 · Valid Accounts T1078.003 · Local Accounts T1078.004 · Cloud Accounts T1087.004 · Cloud Account T1090.002 · External Proxy T1090.003 · Multi-hop Proxy T1090.004 · Domain Fronting T1098.001 · Additional Cloud Credentials T1098.002 · Additional Email Delegate Permissions T1098.005 · Device Registration T1105 · Ingress Tool Transfer T1110.001 · Password Guessing T1110.003 · Password Spraying T1112 · Modify Registry T1114.002 · Remote Email Collection T1127.001 · MSBuild T1133 · External Remote Services T1136.003 · Cloud Account T1176 · Software Extensions T1195.001 · Compromise Software Dependencies and Development Tools T1195.002 · Compromise Software Supply Chain T1199 · Trusted Relationship T1203 · Exploitation for Client Execution T1204 · User Execution T1204.001 · Malicious Link T1204.004 · Malicious Copy and Paste T1218 · System Binary Proxy Execution T1218.005 · Mshta T1218.011 · Rundll32 T1219 · Remote Access Tools T1486 · Data Encrypted for Impact T1505.003 · Web Shell T1528 · Steal Application Access Token T1539 · Steal Web Session Cookie T1543.003 · Windows Service T1546.003 · Windows Management Instrumentation Event Subscription T1546.008 · Accessibility Features T1547.001 · Registry Run Keys / Startup Folder T1548.002 · Bypass User Account Control T1550.003 · Pass the Ticket T1552.001 · Credentials In Files T1552.005 · Cloud Instance Metadata API T1553.005 · Mark-of-the-Web Bypass T1554 · Compromise Host Software Binary T1555.003 · Credentials from Web Browsers T1556.007 · Hybrid Identity T1557 · Adversary-in-the-Middle T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1566.003 · Spearphishing via Service T1567.002 · Exfiltration to Cloud Storage T1568 · Dynamic Resolution T1569.002 · Service Execution T1573 · Encrypted Channel T1573.002 · Asymmetric Cryptography T1574.002 · T1574.002 T1583.006 · Web Services T1586.002 · Email Accounts T1586.003 · Cloud Accounts T1587.001 · Malware T1587.003 · Digital Certificates T1588.002 · Tool T1595.002 · Vulnerability Scanning T1621 · Multi-Factor Authentication Request Generation T1649 · Steal or Forge Authentication Certificates T1651 · Cloud Administration Command T1665 · Hide Infrastructure T1685.002 · Disable or Modify Cloud Log

Detection use cases (24)

Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Remote service execution — PsExec / SMB lateral movement Internal PowerShell encoded / obfuscated command Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal Network connections to article IPs / domains Internal File hash IOCs — endpoint file/process match Internal Article-specific behavioural hunt — DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized rec Internal Beaconing — periodic outbound to small set of destinations Internal 1Password activity from Tor exit node MITRE match 1Password impossible-travel sign-in MITRE match AI-Agent Server (PraisonAI/MCP) Spawns OS Shell or Recon LOLBin — Unauthenticated RCE Exploitation MITRE match AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process MITRE match AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) MITRE match Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) MITRE match Internet-Exposed AI Agent/LLM Service Spawns Shell or LOLBin After Inbound Connection MITRE match

Threat-intel articles (7)

crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure · 2026-08-10

crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide · 2026-08-05

crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm · 2026-08-04

crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET · 2026-08-04

crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft · 2026-07-31

low EasterBunny: advanced espionage artifacts attributed to APT29 · 2026-05-06

crit PlugX Meeting Invitation via MSBuild and GDATA · 2026-02-26

Tracked indicators

Domains (40)

1rpc.io applefilevault.com apricotfilepoint.com bananafastfile.com cloudfilebridge.com cloudsendhub.com deadblogdbdu5wprek7wa2o4 deadlock.liveblog365.com deadlockblog.great-site. deadlockblog.medianewson decoorat.net decoraat.net dlock.liveblog365.com filecedarwallet.online filecopperbasket.sbs filecrimsonsignal.online filemarblegarden.sbs fileoceanhammer.sbs filerubyfolder.sbs filevelvettractor.sbs gesecole.net js-mirror.com lemonfilewave.com limefilescope.com m365-owa.com +15 more

IP addresses (6)

104.194.159.150 107.189.26.194 213.145.86.112 31.57.243.154 38.146.28.132 38.146.28.75