← All actors Recent activity

APT29 G0016

DUKE · UNC2452 · APT29 · BlueBravo · CloudDuke · CosmicDuke · Cozy Bear · CozyDuke · GeminiDuke · HammerDuke · Midnight Blizzard · MiniDuke · NOBELIUM · OnionDuke · PinchDuke · SeaDuke · SilverFish · SoreFang · The Dukes · WellMail · WellMess · captivecrunch · chocoshell · cloaked ursa · cozylarch · dark halo · earth koshchei · goldfinder · goldmax · icecap · raindrop · sibot · solorigate · stellarparticle · storm-2945 · sunburst · sunshuttle · supernova · teardrop

Indicators
1,088
Source reports
150
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-08-02
20152026

Overview 1,088 indicators

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.

domain935G0016-domain.txt
url105G0016.json
ipv439G0016.json
url_path9G0016.json

Techniques 66 ATT&CK

Open in ATT&CK Navigator → or download the layer (66 techniques, layer 4.5)

Software 49

Principal sources 150 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 1,088 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 1,088. Complete: G0016.json.

  1. 1 domainthis year

    x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…

    statistic-g.com

  2. 5 domain, 14 ipv4, 1 url_paththis year

    x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…

    domainm365-owa.com
    domainms365-device.com
    domainms365-live.com
    domainmy-invite.org
    domainowa-ms365.com
    ipv4104.194.159.150:443
    ipv4107.189.26.194:443
    ipv4138.197.202.81:3000
    ipv4138.68.160.124:3000
    ipv4165.22.146.161:3000
    ipv4213.145.86.112:443
    ipv4216.126.224.95:3000
    ipv431.172.83.142:4000
    ipv431.57.243.154:2000
    ipv431.57.243.154:443
    ipv438.146.28.132:443
    ipv438.146.28.75:4000
    ipv438.146.28.75:8443
    ipv484.200.154.162:4000
    url_path/t/pixel.gif?m=

  3. 1 domainthis year

    x.com/BlinkzSec/status/2008479066635039174 · x.com/banthisguy9349/status/20084907471344394…

    rheinemetall.com

  4. or earlier 10 domainthis year

    research.checkpoint.com/2025/apt29-phishing-campaign

    bakenhof.com
    bravecup.com
    info.ophibre.com
    mail.bakenhof.com
    mail.bravecup.com
    mail.ophibre.com
    mail.silry.com
    mx.ophibre.com
    ophibre.com
    silry.com

  5. or earlier 3 domainthis year

    aws.amazon.com/ru/blogs/security/amazon-disrupts-water…

    cloudflare.redirectpartners.com
    findcloudflare.com
    redirectpartners.com

  6. 2 domain, 1 ipv41 yr ago

    x.com/ShanHolo/status/1887817002649047162 · app.validin.com/detail?find=185.243.99.17&type=ip4&ref_… · virustotal.com/gui/file/1916af4debbeaa0ee688c95d2d9d25… · virustotal.com/gui/file/7cfb5e14c49ed3c9425ae995a2f7f2…

    domainukrtelcom.com
    domainukrtelecom.eu
    ipv4185.243.99.17:3389

  7. 1 domain2 yrs ago

    x.com/blackorbird/status/1868948019854643666 · trendmicro.com/en_no/research/24/l/earth-koshchei.html · trendmicro.com/content/dam/trendmicro/global/en/resear…

    police-gov.cloud

  8. 61 domain2 yrs ago

    x.com/blackorbird/status/1868948019854643666 · trendmicro.com/en_no/research/24/l/earth-koshchei.html · trendmicro.com/content/dam/trendmicro/global/en/resear…

    aeinc.solutions
    albrightstonebridge.cloud
    amazonmeeting.cloud
    americanprogress.cloud
    aspeninstitute.cloud
    awsmeetings.online
    c-r.services
    capgemini.services
    cepa.solutions
    citoc.cloud
    clari.cloud
    clearancejobs.cloud
    cnas.zone
    cwinc.cloud
    defence-au.cloud
    democracyendowment.cloud
    ecfr.cloud
    europa-eu.cloud
    exclaimer.solutions
    foreignpolicy.cloud
    freedomhouse.cloud
    gc-cloud.ca
    go-conference.cloud
    go-jp.cloud
    go-meet-up.com
    go-meet.pro
    go-meeting.cloud
    googlemeet.zone
    heritagecloud.org
    justice.technology
    mapn-ro.cloud
    mod-cloud.uk
    morh-hr.cloud
    mvep-hr.cloud
    ncsc.solutions
    ndu.solutions
    nrcc.cloud
    opensocietyfoundations.cloud
    prio.zone
    pulsesecure.cloud
    rrt.solutions
    rubrik.zone
    s3-aws.global
    s3-us.navy
    saiccloud.us
    shicloud.online
    sipacolumbia.us
    skykick.solutions
    softcat.cloud
    ssi-gouv-fr.cloud
    trustifi.cloud
    us-army.cloud
    veeam.solutions
    zixcorp.cloud
    zoom-meeting.cloud
    zoom-meeting.live
    zoom-meeting.pro
    zoom-meeting.today
    zoom-meetings.cloud
    zoommeeting.today
    zoommeeting.zone

  9. 270 domain2 yrs ago

    microsoft.com/en-us/security/blog/2024/10/29/midnight…

    amazonsolutions.cloud
    ap-northeast-1-aws.s3-ua.cloud
    ap-northeast-1-aws.ukrainesec.cloud
    ca-central-1.gov-ua.cloud
    ca-central-1.ua-gov.cloud
    ca-west-1.aws-ukraine.cloud
    ca-west-1.ukrtelecom.cloud
    central-2-aws.ua-mil.cloud
    central-2-aws.ua-sec.cloud
    central-2-aws.ukrainesec.cloud
    central-2-aws.ukrtelecom.cloud
    dep-no.cloud
    eu-central-1-aws.amazonsolutions.cloud
    eu-central-1-aws.dep-no.cloud
    eu-central-1-aws.gov-pl.cloud
    eu-central-1-aws.gov-sk.cloud
    eu-central-1-aws.gov-trust.cloud
    eu-central-1-aws.minbuza.cloud
    eu-central-1-aws.mindef-nl.cloud
    eu-central-1-aws.msz-pl.cloud
    eu-central-1-aws.mzv-sk.cloud
    eu-central-1-aws.ncfta.cloud
    eu-central-1-aws.presidencia-pt.cloud
    eu-central-1-aws.quirinale.cloud
    eu-central-1-aws.regeringskansliet-se.cloud
    eu-central-1-aws.s3-be.cloud
    eu-central-1-aws.s3-ua.cloud
    eu-central-1-aws.ua-gov.cloud
    eu-central-1-aws.ukrainesec.cloud
    eu-central-1.difesa-it.cloud
    eu-central-1.mil-be.cloud
    eu-central-1.mil-pl.cloud
    eu-central-1.minbuza.cloud
    eu-central-1.mindef-nl.cloud
    eu-central-1.msz-pl.cloud
    eu-central-1.quirinale.cloud
    eu-central-1.regeringskansliet-se.cloud
    eu-central-1.s3-be.cloud
    eu-central-1.s3-esa.cloud
    eu-central-1.s3-nato.cloud
    eu-central-1.ua-gov.cloud
    eu-central-1.ua-sec.cloud
    eu-central-2-aws.amazonsolutions.cloud
    eu-central-2-aws.aws-ukraine.cloud
    eu-central-2-aws.dep-no.cloud
    eu-central-2-aws.gov-pl.cloud
    eu-central-2-aws.gov-sk.cloud
    eu-central-2-aws.mil-be.cloud
    eu-central-2-aws.mil-pl.cloud
    eu-central-2-aws.mindef-nl.cloud
    eu-central-2-aws.msz-pl.cloud
    eu-central-2-aws.mzv-sk.cloud
    eu-central-2-aws.presidencia-pt.cloud
    eu-central-2-aws.regeringskansliet-se.cloud
    eu-central-2-aws.s3-be.cloud
    eu-central-2-aws.ua-gov.cloud
    eu-central-2-aws.ua-mil.cloud
    eu-central-2-aws.ukrtelecom.cloud
    eu-east-1-aws.amazonsolutions.cloud
    eu-east-1-aws.dep-no.cloud
    eu-east-1-aws.gov-sk.cloud
    eu-east-1-aws.gov-ua.cloud
    eu-east-1-aws.mil-be.cloud
    eu-east-1-aws.mil-pl.cloud
    eu-east-1-aws.minbuza.cloud
    eu-east-1-aws.mindef-nl.cloud
    eu-east-1-aws.msz-pl.cloud
    eu-east-1-aws.mzv-sk.cloud
    eu-east-1-aws.quirinale.cloud
    eu-east-1-aws.regeringskansliet-se.cloud
    eu-east-1-aws.s3-be.cloud
    eu-east-1-aws.s3-de.cloud
    eu-east-1-aws.ua-gov.cloud
    eu-east-1-aws.ua-sec.cloud
    eu-east-1-aws.ukrtelecom.cloud
    eu-north-1-aws.dep-no.cloud
    eu-north-1-aws.difesa-it.cloud
    eu-north-1-aws.gov-pl.cloud
    eu-north-1-aws.gov-sk.cloud
    eu-north-1-aws.mil-be.cloud
    eu-north-1-aws.mil-pl.cloud
    eu-north-1-aws.minbuza.cloud
    eu-north-1-aws.ncfta.cloud
    eu-north-1-aws.presidencia-pt.cloud
    eu-north-1-aws.quirinale.cloud
    eu-north-1-aws.regeringskansliet-se.cloud
    eu-north-1-aws.s3-be.cloud
    eu-north-1-aws.s3-de.cloud
    eu-north-1.difesa-it.cloud
    eu-north-1.gov-trust.cloud
    eu-north-1.gov-ua.cloud
    eu-north-1.gv-at.cloud
    eu-north-1.mil-be.cloud
    eu-north-1.mil-pl.cloud
    eu-north-1.mzv-sk.cloud
    eu-north-1.ncfta.cloud
    eu-north-1.regeringskansliet-se.cloud
    eu-north-1.s3-be.cloud
    eu-north-1.s3-de.cloud
    eu-north-1.s3-ua.cloud
    eu-south-1-aws.admin-ch.cloud
    eu-south-1-aws.dep-no.cloud
    eu-south-1-aws.difesa-it.cloud
    eu-south-1-aws.gov-pl.cloud
    eu-south-1-aws.gov-trust.cloud
    eu-south-1-aws.mil-be.cloud
    eu-south-1-aws.minbuza.cloud
    eu-south-1-aws.mzv-sk.cloud
    eu-south-1-aws.quirinale.cloud
    eu-south-1-aws.s3-be.cloud
    eu-south-1-aws.s3-de.cloud
    eu-south-1-aws.ua-gov.cloud
    eu-south-2-aws.amazonsolutions.cloud
    eu-south-2-aws.dep-no.cloud
    eu-south-2-aws.gov-pl.cloud
    eu-south-2-aws.gov-sk.cloud
    eu-south-2-aws.mil-be.cloud
    eu-south-2-aws.mil-pl.cloud
    eu-south-2-aws.mil-pt.cloud
    eu-south-2-aws.minbuza.cloud
    eu-south-2-aws.msz-pl.cloud
    eu-south-2-aws.mzv-sk.cloud
    eu-south-2-aws.ncfta.cloud
    eu-south-2-aws.quirinale.cloud
    eu-south-2-aws.regeringskansliet-se.cloud
    eu-south-2-aws.s3-be.cloud
    eu-south-2-aws.s3-de.cloud
    eu-south-2-aws.s3-esa.cloud
    eu-south-2-aws.s3-nato.cloud
    eu-south-2-aws.s3-ua.cloud
    eu-south-2-aws.ua-gov.cloud
    eu-south-2.dep-no.cloud
    eu-south-2.gov-pl.cloud
    eu-south-2.gov-sk.cloud
    eu-south-2.mil-be.cloud
    eu-south-2.mil-pl.cloud
    eu-south-2.mindef-nl.cloud
    eu-south-2.s3-be.cloud
    eu-south-2.s3-de.cloud
    eu-south-2.s3-esa.cloud
    eu-south-2.s3-nato.cloud
    eu-south-2.ua-sec.cloud
    eu-south-2.ukrainesec.cloud
    eu-southeast-1-aws.amazonsolutions.cloud
    eu-southeast-1-aws.aws-ukraine.cloud
    eu-southeast-1-aws.dep-no.cloud
    eu-southeast-1-aws.difesa-it.cloud
    eu-southeast-1-aws.gov-sk.cloud
    eu-southeast-1-aws.gov-trust.cloud
    eu-southeast-1-aws.mil-be.cloud
    eu-southeast-1-aws.mil-pl.cloud
    eu-southeast-1-aws.mindef-nl.cloud
    eu-southeast-1-aws.msz-pl.cloud
    eu-southeast-1-aws.mzv-cz.cloud
    eu-southeast-1-aws.mzv-sk.cloud
    eu-southeast-1-aws.quirinale.cloud
    eu-southeast-1-aws.s3-be.cloud
    eu-southeast-1-aws.s3-de.cloud
    eu-southeast-1-aws.s3-esa.cloud
    eu-southeast-1-aws.s3-ua.cloud
    eu-southeast-1-aws.ua-energy.cloud
    eu-southeast-1-aws.ukrainesec.cloud
    eu-west-1-aws.amazonsolutions.cloud
    eu-west-1-aws.aws-ukraine.cloud
    eu-west-1-aws.dep-no.cloud
    eu-west-1-aws.gov-pl.cloud
    eu-west-1-aws.gov-sk.cloud
    eu-west-1-aws.gov-trust.cloud
    eu-west-1-aws.gov-ua.cloud
    eu-west-1-aws.mil-be.cloud
    eu-west-1-aws.mil-pl.cloud
    eu-west-1-aws.minbuza.cloud
    eu-west-1-aws.quirinale.cloud
    eu-west-1-aws.s3-be.cloud
    eu-west-1-aws.s3-de.cloud
    eu-west-1-aws.s3-esa.cloud
    eu-west-1-aws.s3-nato.cloud
    eu-west-1-aws.ua-sec.cloud
    eu-west-1-aws.ukrainesec.cloud
    eu-west-1.aws-ukraine.cloud
    eu-west-1.difesa-it.cloud
    eu-west-1.gov-sk.cloud
    eu-west-1.mil-be.cloud
    eu-west-1.mil-pl.cloud
    eu-west-1.minbuza.cloud
    eu-west-1.msz-pl.cloud
    eu-west-1.mzv-sk.cloud
    eu-west-1.regeringskansliet-se.cloud
    eu-west-1.s3-de.cloud
    eu-west-1.s3-esa.cloud
    eu-west-1.s3-ua.cloud
    eu-west-1.ua-gov.cloud
    eu-west-1.ukrtelecom.cloud
    eu-west-2-aws.amazonsolutions.cloud
    eu-west-2-aws.dep-no.cloud
    eu-west-2-aws.difesa-it.cloud
    eu-west-2-aws.gov-pl.cloud
    eu-west-2-aws.gov-sk.cloud
    eu-west-2-aws.gv-at.cloud
    eu-west-2-aws.mil-be.cloud

    · 70 more in this batch, in the JSON

Further reading 169

129 more, and the report behind every indicator, in G0016.json.