APT29

Also known as:IRON RITUAL · IRON HEMLOCK · NobleBaron · Dark Halo · NOBELIUM · UNC2452 · YTTRIUM · The Dukes · Cozy Bear · CozyDuke · SolarStorm · Blue Kitsune · UNC3524 · Midnight Blizzard

Overview

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

Naming & attribution

APT29 is tracked under 15 names across the industry. It uses 66 documented ATT&CK techniques — more than 91% of the 174 groups tracked here. Activity attributed since at least 2008.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
IRON RITUAL	Secureworks CTU
IRON HEMLOCK	Secureworks CTU
NobleBaron	Guerrero-Saade, J
Dark Halo	Cash, D. et al
NOBELIUM	Nafisi, R., Lelli, A
UNC2452	FireEye
YTTRIUM	Microsoft Defender Research Team
The Dukes	F-Secure Labs
Cozy Bear	Alperovitch, D.
CozyDuke	Alperovitch, D.
SolarStorm	Unit 42
Blue Kitsune	PWC
UNC3524	Mandiant
Midnight Blizzard	Microsoft
APT29	F-Secure Labs

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1027.006 HTML Smuggling — used by 1 of 174 groups
T1090.004 Domain Fronting — used by 1 of 174 groups
T1098.005 Device Registration — used by 1 of 174 groups
T1556.007 Hybrid Identity — used by 1 of 174 groups
T1649 Steal or Forge Authentication Certificates — used by 1 of 174 groups
T1685.002 Disable or Modify Cloud Log — used by 1 of 174 groups
T1087.004 Cloud Account — used by 2 of 174 groups
T1136.003 Cloud Account — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT28 Russia — 29 shared techniques (22% overlap)
TA2541 — 16 shared techniques (21% overlap)
APT33 Iran — 16 shared techniques (20% overlap)
Threat Group-3390 China — 20 shared techniques (19% overlap)
Magic Hound Iran — 22 shared techniques (18% overlap)
VOID MANTICORE Iran — 20 shared techniques (18% overlap)

Malware families with tracked indicators

One family attributed to APT29, with 323 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Sliver323 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government · Private sector · Think Tanks

Regions

Belgium · Brazil · China · Georgia · Germany · India · Japan · Kazakhstan · Mexico · New Zealand · Portugal · Romania · South Korea · Turkey · Ukraine · United States

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190, T1203
Custom malware/implant development — ATT&CK: 34 attributed custom malware families

TTPs — 66 techniques across 13 tactics

Defense Impairment

Credential Access

T1003.002Security Account Manager
T1003.004LSA Secrets
T1110.001Password Guessing
T1110.003Password Spraying
T1528Steal Application Access Token
T1621Multi-Factor Authentication Request Generation
T1649Steal or Forge Authentication Certificates

Discovery

T1016.001Internet Connection Discovery
T1087.004Cloud Account

Lateral Movement

T1021.007Cloud Services
T1550.003Pass the Ticket

Collection

T1005Data from Local System
T1114.002Remote Email Collection

Command and Control

Tools & malware (49)

PinchDuke · ROADTools · WellMail · CozyCar · Mimikatz · meek · TrailBlazer · Tasklist · OnionDuke · FatDuke · POSHSPY · EnvyScout · SoreFang · GeminiDuke · reGeorg · BloodHound · GoldMax · FoggyWeb · SDelete · PolyglotDuke · AADInternals · MiniDuke · TEARDROP · SeaDuke · Sibot · Raindrop · RegDuke · CloudDuke · GoldFinder · AdFind · PsExec · Tor · NativeZone · Systeminfo · ipconfig · SUNSPOT · Impacket · Cobalt Strike · PowerDuke · Net · QUIETEXIT · HAMMERTOSS · BoomBox · Sliver · CosmicDuke · SUNBURST · WellMess · VaporRage · LiteDuke

Reporting (3)

How Microsoft names threat actors — Microsoft
UNC3524: Eye Spy on Your Email — Mandiant
Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign — CrowdStrike