Also known as: Cozy Bear, The Dukes, Nobelium, Midnight Blizzard, YTTRIUM, UNC2452, Dark Halo, Iron Hemlock, Cloaked Ursa, BlueBravo, UNC6293, CozyLarch, ICECAP, StellarParticle, UAC-0029, APT-C-50, Earth Koshchei, NobleBaron, Blue Kitsune, IRON RITUAL
T1195.002
T1078.004
T1550.001
T1556
T1027.013
T1071.001
T1568.002
T1098.003
T1114.002
T1199
T1621
T1528
T1656
T1550
T1091
T1534
T1213
T1606
T1213.002
T1087.004
T1110.001
T1213.003
T1586.003
T1583.006
T1584.001
T1071.004
T1566.003
T1539
T1567.002
T1649
T1558.003
T1136.003
T1606.002
T1550.004
T1111
T1552.001
T1552.004
T1585.001
T1585.002
T1586.002
T1583.001
T1583.003
T1550.002
T1484.002
T1136.001
T1098.001
T1098.002
T1589.002
T1589.003
T1598.003
T1598.001
T1590.002
T1204.001
T1204.003
T1505.003
T1134
T1543.003
T1012
T1007
T1070.004
T1055.003
T1090.002
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Sophisticated backdoor inserted into SolarWinds Orion software updates (supply chain attack). Used passive DNS-based C2 and multiple evasion techniques to remain undetected for months.
Memory-only dropper deployed via SUNBURST to load Cobalt Strike beacons. Never touched disk, making forensic recovery extremely difficult.
Post-compromise backdoor targeting AD FS servers. Extracts configuration databases and intercepts/modifies SAML tokens for persistent access to cloud resources.
Evolved version of FoggyWeb that manipulates AD FS authentication claims, allowing the actor to authenticate as any user without their credentials.
HTML smuggling tool delivered via spear-phishing emails. Deobfuscates and drops ISO/IMG files containing malicious payloads, bypassing email security gateways.
Cross-platform backdoor (Go/.NET) used to target COVID-19 vaccine research organizations. Supports encrypted C2 communication via HTTP/TLS.
Go-based C2 backdoor deployed as second-stage after SUNBURST. Uses decoy traffic generators and time-based execution guards to evade sandbox analysis.
Backdoor that uses the Microsoft Notion API as C2 channel, blending command traffic with legitimate cloud service usage.
Primary post-exploitation framework used after initial access. Memory-resident beacons provide persistent C2, lateral movement, and credential harvesting capabilities.
Deployed for credential extraction from LSASS memory, Kerberos ticket manipulation (Golden/Silver Tickets), and DCSync attacks for domain-wide compromise.
Commercial red team C2 framework used as an alternative to Cobalt Strike. Designed to evade EDR/AV detection with features like syscall manipulation.
Legitimate remote desktop tool deployed post-compromise for persistent remote access. Harder for defenders to flag as malicious due to legitimate business use.
Used for fileless payload execution, token manipulation, and accessing Microsoft Graph API for cloud environment reconnaissance.
PowerShell module for Azure AD manipulation. Used to extract tokens, modify tenant configurations, and maintain persistent access to Microsoft 365 environments.
Loader malware used in SolarWinds campaign to deploy Cobalt Strike. Used a modified Lempel-Ziv-Markov chain algorithm for steganographic payload hiding.
Open-source C2 framework used as alternative to Cobalt Strike. Supports mTLS, WireGuard, DNS, and HTTP C2 channels with cross-platform implants.
Malicious ISO-based loader used to deploy additional payloads
Custom backdoor delivered via ISO files in phishing campaigns
Modular backdoor targeting diplomatic entities
Python-based backdoor with web shell capabilities
Shellcode-based backdoor deployed in recent campaigns
Downloader used to fetch and execute additional payloads
Custom malicious OAuth application for email access
Backdoor utilizing GIF image steganography for C2 communications
HTTP-based backdoor with modular capabilities for espionage operations
Legitimate cloud storage sync tool abused for data exfiltration operations
Loader used to deliver second-stage payloads in targeted operations
Backdoor implant with persistence and data exfiltration capabilities
Backdoor malware used for persistent access and command execution
Legitimate tunneling tool abused for establishing covert command and control channels
Loader component used in multi-stage infection chains
Cloud-focused backdoor using Microsoft Graph API for C2 communications
Loader component used in 2024 campaigns to deploy additional payloads
Backdoor utilizing legitimate cloud services for command and control
Cloud-aware backdoor utilizing Microsoft Graph API for C2 communications, deployed in Microsoft 365 environments
| Type | Value |
|---|---|
| domain | avsvmcloud[.]com |
| domain | freescanonline[.]com |
| domain | theyardservice[.]com |
| ip | 13[.]59[.]205[.]66 |
| ip | 54[.]193[.]127[.]66 |
| hash | b91ce2fa41029f6955bff20079468448 |
| domain | bakenhof[.]com |
| domain | silry[.]com |
| domain | bravecup[.]com |
| hash | 653db3b63bb0e8c2db675cd047b737cefebb1c955bd99e7a93899e2144d34358 |
| hash | 78a810e47e288a6aff7ffbaf1f20144d2b317a1618bba840d42405cddc4cff41 |
| hash | d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164 |
| domain | dataplane[.]theyardservice[.]com |
| domain | msedgepackageinfo[.]com |
| domain | cdn[.]msstatic[.]com |
| hash | fc2c3d3d2b0f9a6e5c8f5e4d3c2b1a0987654321fedcba0987654321fedcba09 |
| domain | dataplane[.]cakewalkcompany[.]com |
| domain | tigertigerberawwr[.]com |
| domain | royalroad[.]quest |
| domain | graphicartisans[.]org |
| domain | statisticse[.]eu |
| domain | eventstable[.]com |
| domain | securityupdateserver[.]com |
| domain | rsvp-viewer[.]com |
| domain | invitations[.]diplomataffairs[[.]]com |
| domain | rsvp-diplomatie[[.]]com |
| hash | 1b0a426f9b7853f85a6f8e4f3a9e3e9d9e9c0f5a5e3e3e2e1e0e0f0f0f0f0f0f |
| domain | findcloudflare[.]com |
| domain | cloudflare[.]redirectpartners[.]com |
| domain | aerofluidthermo[.]org |
| ip | 91[.]190[.]191[.]117 |
| hash | b4141aa8d234137f0b9549a448158a95 |
| hash | 295527e2e38da97167979ade004de880 |
| Domain / Host | Status |
|---|---|
avsvmcloud[.]comSUNBURST C2 domain (SolarWinds attack) | ip_changed |
freescanonline[.]comC2 infrastructure for SUNBURST second-stage | whois_changed |
theyardservice[.]comNobelium phishing infrastructure (2021) | active |
13[.]59[.]205[.]66SolarWinds SUNBURST C2 infrastructure | offline |
54[.]193[.]127[.]66C2 node used in government targeting | offline |
bakenhof[.]com | whois_changed |
silry[.]com | active |
bravecup[.]com | whois_changed |
findcloudflare[.]com | unknown |
cloudflare[.]redirectpartners[.]com | unknown |
aerofluidthermo[.]org | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - APT29
https://attack.mitre.org/groups/G0016/
Microsoft - Midnight Blizzard (Nobelium)
https://www.microsoft.com/en-us/security/blog/threat-intelligence/midnight-blizzard-nobelium/
CISA - SolarWinds Supply Chain Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
Check Point: Renewed APT29 Phishing Campaign Against European Diplomats
https://research.checkpoint.com/2025/apt29-phishing-campaign/
Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Google: What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia
https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia
Citizen Lab: Russian Government-Linked Social Engineering Targets App-Specific Passwords
https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/
Picus: Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign
https://www.picussecurity.com/resource/blog/understanding-and-mitigating-midnight-blizzards-rdp-based-spearphishing-campaign
Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack
https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Mandiant: Suspected APT29 Operation Launches Election Fraud-Themed Phishing Campaigns
https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
CISA: Russian Foreign Intelligence Service SVR Exploiting JetBrains TeamCity CVE Globally
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Volexity: Ongoing Investigation into CVE-2023-42793 Exploitation by APT29
https://www.volexity.com/blog/2023/10/13/cve-2023-42793-quick-assessment-guide/
Unit 42: NOBELIUM Targets Government Agencies with HTML Smuggling
https://unit42.paloaltonetworks.com/nobelium-targets-government-html-smuggling/
CERT-UA Report on APT29 Targeting Ukrainian Entities
https://cert.gov.ua/article/6280661
Unit 42: ROOTSAW Dropper Delivers WINELOADER
https://unit42.paloaltonetworks.com/rootsaw-wineloader-malware/
NCSC and partners issue advisory on APT29 targeting of cloud services
https://www.ncsc.gov.uk/news/uk-allies-issue-advisory-apt29-targeting-cloud-services
CISA APT29 SVR Cyber Operations Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
Microsoft: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/
CERT-EU: APT29 Deploys WINELOADER in Diplomatic-Themed Phishing Campaign
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-001/
NCSC: APT29 Targeting UK Political and Diplomatic Entities
https://www.ncsc.gov.uk/news/advisory-apt29-targets-cloud-services
Google Threat Intelligence: APT29 WINELOADER Targeting German Political Parties
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Google Threat Intelligence: Russian APT29 Exploits Gmail App Passwords
https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns
AWS Security Blog: Amazon Disrupts Watering Hole Campaign by Russia's APT29
https://aws.amazon.com/blogs/security/amazon-disrupts-watering-hole-campaign-by-russias-apt29/
Microsoft Security Blog: New Star Blizzard Spear-Phishing Campaign Targets WhatsApp Accounts
https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/
Mandiant: Backchannel Diplomacy - APT29's Rapidly Evolving Diplomatic Phishing Operations
https://cloud.google.com/blog/topics/threat-intelligence/apt29-evolving-diplomatic-phishing
TeamViewer Security Bulletin TV-2024-1005
https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2024-1005/
NCSC advisory: SVR cyber actors adapt tactics for initial cloud access
https://www.ncsc.gov.uk/news/svr-actors-adapt-tactics-for-initial-cloud-access
Mandiant: Cutting Edge Part 4 - Navigating North Korean Threat Data Landscapes
https://cloud.google.com/blog/topics/threat-intelligence/navigating-north-korean-threat-data-landscapes
NCSC: APT29 targets air-gapped systems
https://www.ncsc.gov.uk/news/russian-state-actors-target-air-gapped-systems
Mandiant: Cutting Edge Part 3 - BOOMMIC
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-3-boommic
Volexity: Dark Halo Leverages SolarWinds Compromise to Breach Organizations
https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/