AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT29
Aliases: APT29, Blue Kitsune, Cozy Bear, CozyDuke, Dark Halo, IRON HEMLOCK, IRON RITUAL, Midnight Blizzard, NOBELIUM, NobleBaron, SolarStorm, The Dukes, UNC2452, UNC3524, YTTRIUM
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021) In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)
Open interactive actor investigation
ATT&CK techniques
T1003.002T1003.004T1005T1016.001T1021.007T1027.001T1027.002T1027.006T1036.005T1037T1037.004T1047T1053.005T1059.001T1059.006T1059.009T1068T1070.004T1070.006T1078T1078.003T1078.004T1087.004T1090.002T1090.003T1090.004T1098.002T1098.005T1105T1110.001T1110.003T1114.002T1133T1136.003T1190T1199T1203T1204.001T1204.002T1218.005T1505.003T1528T1546.003T1546.008T1547.001T1548.002T1550.003T1553.005T1556.007T1566.001T1566.002T1566.003T1568T1573T1583.006T1586.002T1586.003T1587.001T1587.003T1588.002T1595.002T1621T1649T1651T1665T1685.002
Correlated CTI and IR reports
ATT&CK as a Working Tool: Theory and Hands-On Practical Usage
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionMalicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based Detection
1200km CTI repository · explicit report mentionATT CK as a Working Tool Theory and Hands On Practical Usage
1200km Medium · authored report mentionApplying Sherman Kent s Analytic Discipline to CTI A Practical Analyst Guide
1200km Medium · authored report mentionAttribution Methodology How to Build Defend and Challenge a Threat Actor Attribution
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionMalicious Activity as a Statistical Signal A Detection Engineering Analysis of Anomaly Based
1200km Medium · authored report mention
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionMalicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based Detection
1200km CTI repository · explicit report mentionATT CK as a Working Tool Theory and Hands On Practical Usage
1200km Medium · authored report mentionApplying Sherman Kent s Analytic Discipline to CTI A Practical Analyst Guide
1200km Medium · authored report mentionAttribution Methodology How to Build Defend and Challenge a Threat Actor Attribution
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionMalicious Activity as a Statistical Signal A Detection Engineering Analysis of Anomaly Based
1200km Medium · authored report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Systeminfo tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ipconfig tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- meek tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- SDelete tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- BloodHound tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AdFind tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Sliver tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AADInternals tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ROADTools tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.002 Security Account Manager simulation — Exact active technique ID
- T1003.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.004 LSA Secrets simulation — Exact active technique ID
- T1003.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016.001 Internet Connection Discovery simulation — Exact active technique ID
- T1016.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.007 Cloud Services simulation — Exact active technique ID
- T1021.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.001 Binary Padding simulation — Exact active technique ID
- T1027.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.006 HTML Smuggling simulation — Exact active technique ID
- T1027.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037 Boot or Logon Initialization Scripts simulation — Exact active technique ID
- T1037 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037.004 RC Scripts simulation — Exact active technique ID
- T1037.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.009 Cloud API simulation — Exact active technique ID
- T1059.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.004 Cloud Account simulation — Exact active technique ID
- T1087.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.003 Multi-hop Proxy simulation — Exact active technique ID
- T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.004 Domain Fronting simulation — Exact active technique ID
- T1090.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.002 Additional Email Delegate Permissions simulation — Exact active technique ID
- T1098.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.005 Device Registration simulation — Exact active technique ID
- T1098.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.001 Password Guessing simulation — Exact active technique ID
- T1110.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.003 Password Spraying simulation — Exact active technique ID
- T1110.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.002 Remote Email Collection simulation — Exact active technique ID
- T1114.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.003 Cloud Account simulation — Exact active technique ID
- T1136.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.005 Mshta simulation — Exact active technique ID
- T1218.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1528 Steal Application Access Token simulation — Exact active technique ID
- T1528 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.003 Windows Management Instrumentation Event Subscription simulation — Exact active technique ID
- T1546.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.008 Accessibility Features simulation — Exact active technique ID
- T1546.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548.002 Bypass User Account Control simulation — Exact active technique ID
- T1548.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1550.003 Pass the Ticket simulation — Exact active technique ID
- T1550.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.005 Mark-of-the-Web Bypass simulation — Exact active technique ID
- T1553.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1556.007 Hybrid Identity simulation — Exact active technique ID
- T1556.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.003 Spearphishing via Service simulation — Exact active technique ID
- T1566.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1568 Dynamic Resolution simulation — Exact active technique ID
- T1568 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573 Encrypted Channel simulation — Exact active technique ID
- T1573 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.002 Email Accounts simulation — Exact active technique ID
- T1586.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.003 Cloud Accounts simulation — Exact active technique ID
- T1586.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.003 Digital Certificates simulation — Exact active technique ID
- T1587.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1621 Multi-Factor Authentication Request Generation simulation — Exact active technique ID
- T1621 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1649 Steal or Forge Authentication Certificates simulation — Exact active technique ID
- T1649 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1651 Cloud Administration Command simulation — Exact active technique ID
- T1651 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1665 Hide Infrastructure simulation — Exact active technique ID
- T1665 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.002 Disable or Modify Cloud Log simulation — Exact active technique ID
- T1685.002 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameCloud, DevSecOps, product, and control-as-code governance
Governance, Risk & Compliance (GRC) · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameCloud, DevSecOps, product, and control-as-code governance
Governance, Risk & Compliance (GRC) · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Multi-government assessment of APT29 vaccine-development targeting in 2020. Evidence cutoff: 2026-09-25.