apt29-cozy-bear

name	apt29-cozy-bear
description	Adversary-emulation profile for APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM / The Dukes), Russia's SVR-attributed cyber-espionage group, mapping its ATT&CK TTPs to Decepticon emulation tooling.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"APT29, Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, CozyDuke, UNC2452, Dark Halo, SVR, Russian state-sponsored espionage, SolarWinds emulation, golden SAML, OAuth abuse, password spray cloud access, supply chain compromise emulation, stealthy long-dwell APT emulation","tags":"apt29, cozy-bear, midnight-blizzard, nobelium, the-dukes, svr, russia, espionage, cloud-attack, golden-saml, oauth-abuse, supply-chain, password-spray, adversary-emulation, mitre-attack, G0016","mitre_attack":"T1595.002, T1589.001, T1598.003, T1566.001, T1566.002, T1566.003, T1190, T1195.002, T1199, T1133, T1078, T1078.002, T1078.003, T1078.004, T1204.001, T1204.002, T1059.001, T1059.003, T1059.005, T1059.009, T1106, T1053.005, T1047, T1569.002, T1547.001, T1546.003, T1098.001, T1098.002, T1098.003, T1098.005, T1136.003, T1556.007, T1505.003, T1543.003, T1068, T1548.002, T1484.002, T1027.006, T1027.002, T1036.005, T1070.004, T1070.006, T1070.008, T1218.011, T1553.002, T1497, T1620, T1110.003, T1003.003, T1003.006, T1003.001, T1558.003, T1606.001, T1606.002, T1528, T1539, T1621, T1555.003, T1649, T1087.002, T1087.004, T1018, T1482, T1526, T1538, T1069.002, T1021.001, T1021.006, T1021.007, T1550.001, T1550.002, T1550.003, T1570, T1114.002, T1213, T1530, T1560.001, T1071.001, T1071.004, T1573.002, T1090.004, T1568, T1102.002, T1041, T1567.002, T1048"}

APT29 (Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes) — Adversary Emulation Profile

APT29 (MITRE ATT&CK G0016; also tracked as Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, CozyDuke, UNC2452, Dark Halo, NobleBaron, YTTRIUM, Blue Kitsune, IRON RITUAL/IRON HEMLOCK) is a Russian state-sponsored cyber-espionage group attributed by multiple governments to Russia's Foreign Intelligence Service (SVR). Active since at least 2008, it is among the most operationally disciplined intrusion sets on record: it favors patient, stealthy, long-dwell access against high-value strategic targets, custom and living-off-the-land tooling, rigorous operational security (residential-proxy infrastructure, anti-forensic indicator removal, low-and-slow authentication attacks), and a sustained pivot toward cloud and identity-plane attacks (Microsoft 365 / Entra ID, OAuth, federation). It is best known for the 2015–2016 DNC intrusion, the 2020 SolarWinds Orion supply-chain compromise, and the 2024 Microsoft corporate-email breach. This profile teaches Decepticon to emulate APT29's signature TTPs so an authorized red team can exercise the blue cell against a realistic, identity-and-cloud-centric espionage adversary.

Attribution & motivation

• Suspected sponsor / nation: Russian Federation — Foreign Intelligence Service (Sluzhba Vneshney Razvedki, SVR). Attribution is publicly asserted by the U.S. government (CISA/FBI/NSA), the UK NCSC, Canada's CSE, and corroborated by vendor reporting (Mandiant/Google, Microsoft, CrowdStrike).
• Motivation: Strategic espionage — collection of foreign-policy, diplomatic, defense, government, and technology intelligence in support of Russian state interests. APT29 is not financially motivated and is not primarily a destructive actor; its goal is durable, covert access and exfiltration of intelligence, not disruption.
• Confidence: High for SVR attribution — it is the consensus of multiple Five Eyes governments and independent commercial vendors, reinforced by consistent tradecraft across a decade-plus of operations.

Targeting

• Sectors: National governments and foreign ministries, diplomatic missions/embassies, think tanks and policy research institutes, defense and military organizations, IT and managed/cloud service providers (used as a stepping stone to downstream victims), technology companies, healthcare/pharmaceutical and vaccine research (2020), and aviation/education/law enforcement (post-SolarWinds expansion).
• Regions: Primarily NATO and Western-aligned states — United States, United Kingdom, Europe broadly, and other governments of intelligence interest to Russia.
• Victim profile: Organizations holding information of strategic value to Russian foreign policy and security. APT29 frequently exploits trusted relationships (T1199) — compromising cloud solution providers, MSPs, and software vendors to reach the ultimate intelligence target downstream.

Notable campaigns

• 2008–2018 — "The Dukes" espionage operations. Long-running campaigns against Western governments and think tanks using the MiniDuke/CosmicDuke/CozyDuke/SeaDuke/HAMMERTOSS toolset. (MITRE ATT&CK G0016: https://attack.mitre.org/groups/G0016/)
• 2015–2016 — U.S. Democratic National Committee (DNC) compromise. Spearphishing-led intrusion attributed to APT29 alongside APT28. (MITRE ATT&CK G0016: https://attack.mitre.org/groups/G0016/)
• 2020 — COVID-19 vaccine research targeting (WellMess / WellMail). NCSC/CSE/CISA/NSA joint advisory (16 July 2020) detailed APT29 targeting vaccine-development organizations in the UK, US, and Canada, exploiting internet-facing CVEs (Citrix, Pulse Secure, FortiGate, Zimbra), spearphishing for credentials, and deploying the WellMess and WellMail implants. (NCSC: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development)
• Aug 2019 – Jan 2021 — SolarWinds Orion supply-chain compromise (ATT&CK Campaign C0024; UNC2452/"SolarStorm"; SUNBURST). APT29 trojanized SolarWinds Orion updates (versions 2019.4–2020.2.1), reaching ~18,000 organizations, then selectively deployed TEARDROP/RAINDROP loaders for Cobalt Strike and forged SAML tokens ("Golden SAML") to access Microsoft 365 and Azure AD. Publicly disclosed 13 December 2020. (MITRE C0024: https://attack.mitre.org/campaigns/C0024/ ; Mandiant/Google: https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor)
• Since Sept 2023 — JetBrains TeamCity exploitation (CVE-2023-42793). FBI/CISA/NSA/NCSC/Polish SKW joint advisory (AA23-347A) attributed large-scale exploitation of the TeamCity authentication-bypass flaw to the SVR, deploying the GraphicalProton backdoor for follow-on espionage and software supply-chain positioning. (CISA AA23-347A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a)
• Nov 2023 – Jan 2024 — Microsoft corporate email breach ("Midnight Blizzard"). Password-spray (from residential proxies) against a legacy non-production test tenant account lacking MFA; abuse of a legacy test OAuth application granted the Exchange Online full_access_as_app role to read corporate mailboxes (incl. senior leadership). Detected 12 Jan 2024. (Microsoft MSRC: https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard ; Microsoft Security: )

TTPs by ATT&CK tactic

Initial Access

• T1566.001 / .002 / .003 — Spearphishing via attachment, link, and trusted service; HTML-smuggling lures (e.g., EnvyScout) deliver droppers.
• T1190 — Exploit public-facing applications, including CVE-2023-42793 (JetBrains TeamCity) and 2020 edge appliance CVEs (Citrix, Pulse Secure, FortiGate, Zimbra).
• T1195.002 — Software supply-chain compromise (trojanized SolarWinds Orion builds → SUNBURST).
• T1199 — Trusted-relationship abuse: compromise of cloud solution providers, MSPs, and vendors to reach downstream victims.
• T1133 — External remote services / valid-account access to VPNs and remote portals.
• T1078 / .004 — Valid accounts, especially cloud accounts (compromised O365/Entra admins, dormant test tenants).

Execution

• T1059.001 / .003 / .005 / .009 — PowerShell, Windows command shell, VBScript, and Cloud API execution.
• T1204.001 / .002 — User execution of malicious links and files.
• T1106 — Native API; T1047 — WMI; T1569.002 — service execution.

Persistence

• T1547.001 — Registry Run keys / Startup folder; T1546.003 — WMI event subscription.
• T1053.005 — Scheduled tasks.
• T1098.001 / .002 / .003 / .005 — Cloud account manipulation: add credentials to service principals/OAuth apps, grant additional email-delegate and cloud-role permissions, and register attacker devices.
• T1136.003 — Create new cloud accounts; T1556.007 — modify hybrid-identity authentication.
• T1505.003 — Web shells; T1543.003 — Windows service.

Privilege Escalation

• T1068 — Exploitation for privilege escalation; T1548.002 — UAC bypass.
• T1484.002 — Domain/tenant trust modification (add federated IdP / trusted domain to mint tokens).

Defense Evasion

• T1027.006 — HTML smuggling; T1027.002 — software packing.
• T1036.005 — Match legitimate name/location; T1218.011 — rundll32 proxy execution.
• T1070.004 / .006 / .008 — File deletion (sdelete), timestomp, and clear mailbox data.
• T1553.002 — Code signing with valid/abused certificates; T1497 — sandbox/VM evasion; T1620 — reflective/in-memory loading (TEARDROP).
• Operational hallmark: residential-proxy / "TOR-like" rotating egress to defeat IOC- and geo-based detection.

Credential Access

• T1110.003 — Password spraying (low-and-slow, distributed proxies).
• T1003.001 / .003 / .006 — LSASS dumping, NTDS.dit theft, and DCSync.
• T1558.003 — Kerberoasting.
• T1606.001 / .002 — Forge web cookies and forge SAML tokens ("Golden SAML") using a stolen ADFS token-signing certificate.
• T1528 — Steal application access tokens; T1539 — steal web session cookies; T1621 — MFA request generation (push bombing/fatigue).
• T1555.003 — Credentials from browsers; T1649 — steal/forge authentication certificates.

Discovery

• T1087.002 / .004 — Domain and cloud account discovery; T1018 — remote system discovery.
• T1482 — Domain-trust discovery; T1069.002 — domain group discovery.
• T1526 — Cloud service discovery; T1538 — cloud service dashboard enumeration.

Lateral Movement

• T1021.001 / .006 / .007 — RDP, WinRM, and cloud services (e.g., Exchange Online via OAuth app).
• T1550.001 / .002 / .003 — Use of alternate auth material: application access tokens, pass-the-hash, pass-the-ticket.
• T1570 — Lateral tool transfer.

Collection

• T1114.002 — Remote email collection (cloud mailboxes, the SolarWinds and Midnight Blizzard objective).
• T1213 — Data from information repositories; T1530 — data from cloud storage.
• T1560.001 — Archive collected data via utility before exfil.

Command & Control

• T1071.001 / .004 — Web (HTTPS) and DNS C2; T1102.002 — bidirectional web-service C2 (HAMMERTOSS used Twitter/GitHub/cloud storage as dead-drops).
• T1573.002 — Asymmetric encrypted channels; T1568 — dynamic resolution; T1090.004 — domain fronting.

Exfiltration

• T1041 — Exfiltration over C2 channel.
• T1567.002 — Exfiltration to cloud storage.
• T1048 — Exfiltration over alternative protocol.

Impact

• APT29 is an espionage actor; it deliberately avoids destructive impact. The "impact" of an APT29 operation is confidentiality loss (mass mailbox and document theft) and durable strategic access, not data destruction or ransom.

Signature tooling & malware

• Custom backdoors / implants (custom): SUNBURST (S0559), TEARDROP (S0560), RAINDROP, GoldMax/SUNSHUTTLE (S0588), GoldFinder (S0597), Sibot, BoomBox (S0635), EnvyScout (S0634), FoggyWeb (S0661), MagicWeb, GraphicalProton, WellMess, WellMail, the "Duke" family (MiniDuke, CosmicDuke S0050, CozyCar S0046, SeaDuke, HAMMERTOSS S0037, PolyglotDuke, RegDuke, FatDuke S0512, LiteDuke S0513, GeminiDuke S0049, CloudDuke S0054), POSHSPY, SUNSPOT (build-process implant).
• Identity / cloud tooling (custom + public): AADInternals (S0677) for Entra ID / federation abuse and SAML-token operations; custom .NET utilities to extract ADFS token-signing certificates for Golden SAML.
• Commodity / dual-use (public): Cobalt Strike (S0154) BEACON, Impacket (S0357), Mimikatz, BloodHound (S0521), AdFind (S0552), sdelete, ipconfig (S0100), and other living-off-the-land binaries.

Emulation guidance (Decepticon)

Authorized use only. Execute these TTPs strictly within the documented rules of engagement, target scope, and time window of a signed authorization. Do not touch out-of-scope tenants, accounts, or third parties.

Emulate APT29's style, not just its techniques: be patient, quiet, and identity-centric. Prefer valid credentials and cloud/OAuth paths over noisy malware; rotate egress; clean up artifacts.

• Initial access (T1566.x, T1190, T1110.003): Use the bash tool and phishing/payload tooling to stage HTML-smuggling lures mirroring EnvyScout, and exercise the defense-evasion skill to package droppers. For cloud-first emulation, run low-and-slow password spraying via the cloud skill against in-scope test/dormant identities — small attempt counts, spread over time, sourced from approved rotating/proxy egress to mimic residential infrastructure.
• Supply-chain & trusted-relationship (T1195.002, T1199): Where the engagement authorizes a build-pipeline or vendor-trust scenario, use the bash/CI tooling to plant a benign marker in a build artifact to validate that build-integrity and downstream-trust controls fire — never ship a real backdoor to production.
• Execution & C2 (T1059.001, T1071.001, T1573.002, T1090.004): Use the c2/sliver skill as the BEACON/TEARDROP analogue — HTTPS beacons with long jitter, asymmetric encryption, optional domain-fronting/redirector chains, and DNS fallback to reproduce APT29's encrypted, resilient C2.
• Credential access & identity abuse (T1003.006, T1558.003, T1606.002, T1528, T1550.001): Use the AD skills to demonstrate DCSync, Kerberoasting, and NTDS extraction in scope; use the cloud skill (Entra ID / AADInternals-style workflows) to emulate Golden SAML token forging from a captured/lab signing certificate, OAuth application-token theft, and consent-grant abuse — the defining Midnight Blizzard play.
• Persistence (T1098.x, T1136.003, T1484.002): Via the cloud skill, register a controlled service principal / OAuth app, add credentials to it, grant a scoped mailbox/Graph permission, and (where authorized) add a federated trust — then verify the blue cell detects the new app, consent grant, and federation change.
• Lateral movement & collection (T1021.007, T1550.x, T1114.002): Use the lateral-movement skill for pass-the-ticket/token reuse on-prem, and the cloud skill to pivot into Exchange Online via the consented app and perform scoped mailbox collection that mirrors the real objective.
• Defense evasion & exfil (T1070.x, T1620, T1567.002): Use the defense-evasion skill for in-memory loading, timestomping, and log/mailbox-artifact cleanup, and stage scoped exfiltration to an approved cloud-storage endpoint to test DLP and egress monitoring.

Detection & defense

• Identity is the control plane. Enforce phishing-resistant MFA on every account including legacy/service/test tenants; eliminate dormant accounts; apply conditional access and block legacy auth. The Midnight Blizzard root cause was an MFA-less legacy tenant (mitigates T1110.003, T1078.004).
• Password spray / brute force (T1110.003): Alert on many accounts × few attempts from rotating IPs; correlate residential-proxy / ASN-anomalous sign-ins rather than relying on per-IP IOCs.
• OAuth & consent abuse (T1528, T1098.001/.003, T1550.001): Audit and alert on new/over-privileged OAuth app registrations and consent grants — especially full_access_as_app, ApplicationImpersonation, and Graph mail scopes; review credentials added to service principals; use Microsoft Defender for Cloud Apps / Entra ID Protection anomaly detection.
• Federation & Golden SAML (T1606.002, T1484.002, T1556.007): Protect and monitor the ADFS/Entra token-signing certificate; alert on new federated domains/trusts and on tokens minted outside the IdP; review Set-MSOLDomainAuthentication-equivalent changes.
• On-prem credential theft (T1003.006, T1558.003): Monitor for DCSync (non-DC replication requests), LSASS access, NTDS.dit copy, and Kerberoasting; restrict Domain Admin and replication rights.
• Supply chain (T1195.002, T1199): Enforce build-pipeline integrity, code-signing verification, and least-privilege for vendor/CSP delegated access; monitor partner/delegated-admin activity.
• C2 & exfil (T1071.001, T1090.004, T1567.002, T1041): Inspect TLS for domain-fronting and anomalous SNI/host mismatches; baseline DNS; apply DLP and egress controls on cloud-storage uploads and bulk mailbox export (MailItemsAccessed/EWS audit).
• Anti-forensics (T1070.004/.006/.008): Centralize and protect logs (mailbox-audit, unified audit, Sysmon, EDR) with off-host retention so APT29's file deletion, timestomping, and mailbox-data clearing cannot blind the responder.

Sources

• MITRE ATT&CK — APT29 (G0016): https://attack.mitre.org/groups/G0016/
• MITRE ATT&CK — SolarWinds Compromise (Campaign C0024): https://attack.mitre.org/campaigns/C0024/
• CISA AA24-057A — SVR Cyber Actors Adapt Tactics for Initial Cloud Access: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a
• CISA AA23-347A — Russian SVR Exploiting JetBrains TeamCity CVE-2023-42793 Globally: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
• Microsoft MSRC — Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard: https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard
• Microsoft Security Blog — Midnight Blizzard: Guidance for responders on nation-state attack: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
• NCSC — Advisory: APT29 targets COVID-19 vaccine development: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development
• Mandiant / Google Cloud — SUNBURST backdoor SolarWinds supply-chain compromise: https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
• Mandiant / Google Cloud — UNC2452 Merged into APT29: https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29