PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
MITRE ATT&CK G0016

APT29

View MITRE Group Page ↗
Aliases: Cozy Bear, Nobelium, Midnight Blizzard, The Dukes, SVR
Official Attribution Source: CISA Advisory AA20-352A & White House Statement

Key Facts

Jurisdiction
Russian Federation
Geographic origin
Cases
3
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
  • Attributed Country: Russian Federation.
  • ATT&CK Group Reference: G0016 (APT29).
  • Linked to 3 primary court prosecution record(s) with $376.0 million documented loss.
  • Identified 0 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to APT29 Technique frequencies extracted from verified indictments for APT29. T1190 Exploit Public-Facing Application 1 incidents T1071.001 Web Protocols 1 incidents T1078 Valid Accounts 1 incidents T1132 Data Encoding 1 incidents T1036 Masquerading 1 incidents T1110 Brute Force 1 incidents T1041 Exfiltration Over C2 Channel 1 incidents
Technique frequencies extracted from verified indictments for APT29.
ATT&CK Techniques Mapped to APT29
Technique Frequency
T1190 Exploit Public-Facing Application 1 incidents
T1071.001 Web Protocols 1 incidents
T1078 Valid Accounts 1 incidents
T1132 Data Encoding 1 incidents
T1036 Masquerading 1 incidents
T1110 Brute Force 1 incidents
T1041 Exfiltration Over C2 Channel 1 incidents

Prosecution Cases Attributed to APT29

SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)

alleged 2020-12-13

Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.

Primary Attack Mechanism: Russian Foreign Intelligence Service (SVR / APT29) operatives infiltrated SolarWinds internal software development environment and modified the automated build pipeline to inject the SUNBURST backdoor into legitimate Orion DLL source files.
5 techniques mapped · Loss: $200.0 million View full case dossier →

Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)

investigation 2024-01-19

Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.

Primary Attack Mechanism: Russian Foreign Intelligence Service (SVR / Midnight Blizzard) conducted a password spray attack against a legacy, non-production test tenant account that lacked multi-factor authentication.
3 techniques mapped · Loss: $150.0 million View full case dossier →

SEC v. SolarWinds Corp. & CISO Timothy G. Brown (Securities Fraud)

charged 2023-10-30

Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.

Primary Attack Mechanism: Initial access established against Public Markets & Corporate Governance infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.
1 techniques mapped · Loss: $26.0 million View full case dossier →

Documented TTP Signature for APT29

Test Controls in Stack Audit →
T1190: Exploit Public-Facing Application

Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.
T1071.001: Web Protocols

Adversaries communicate using standard HTTP and HTTPS web protocols to blend with regular traffic.
T1078: Valid Accounts

Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1132: Data Encoding

Adversaries encode data with standard algorithms to make communications and metadata more difficult to inspect.
T1036: Masquerading

Adversaries manipulate features of their artifacts to make them appear legitimate or benign.
T1110: Brute Force

Adversaries use automated credential guessing or password spraying against authentication portals.