Overview 1,088 indicators
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.
| domain | 935 | G0016-domain.txt |
| url | 105 | G0016.json |
| ipv4 | 39 | G0016.json |
| url_path | 9 | G0016.json |
Techniques 66 ATT&CK
Open in ATT&CK Navigator → or download the layer (66 techniques, layer 4.5)
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1016.001 Internet Connection Discovery
- T1021.007 Cloud Services
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.006 HTML Smuggling
- T1036.005 Match Legitimate Resource Name or Location
- T1037 Boot or Logon Initialization Scripts
- T1037.004 RC Scripts
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1059.006 Python
- T1059.009 Cloud API
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1078 Valid Accounts
- T1078.003 Local Accounts
- T1078.004 Cloud Accounts
- T1087.004 Cloud Account
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1098.002 Additional Email Delegate Permissions
- T1098.005 Device Registration
- T1105 Ingress Tool Transfer
- T1110.001 Password Guessing
- T1110.003 Password Spraying
- T1114.002 Remote Email Collection
- T1133 External Remote Services
- T1136.003 Cloud Account
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.005 Mshta
- T1505.003 Web Shell
- T1528 Steal Application Access Token
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.008 Accessibility Features
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1550.003 Pass the Ticket
- T1553.005 Mark-of-the-Web Bypass
- T1556.007 Hybrid Identity
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1583.006 Web Services
- T1586.002 Email Accounts
- T1586.003 Cloud Accounts
- T1587.001 Malware
- T1587.003 Digital Certificates
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1621 Multi-Factor Authentication Request Generation
- T1649 Steal or Forge Authentication Certificates
- T1651 Cloud Administration Command
- T1665 Hide Infrastructure
- T1685.002 Disable or Modify Cloud Log
Software 49
- Mimikatz
- PsExec
- HAMMERTOSS
- Net
- CozyCar
- PinchDuke
- GeminiDuke
- CosmicDuke
- MiniDuke
- OnionDuke
- SeaDuke
- CloudDuke
- Tasklist
- Systeminfo
- ipconfig
- PowerDuke
- POSHSPY
- Cobalt Strike
- meek
- Tor
- SDelete
- Impacket
- RegDuke
- FatDuke
- LiteDuke
- WellMess
- WellMail
- SoreFang
- PolyglotDuke
- BloodHound
- AdFind
- SUNBURST
- TEARDROP
- SUNSPOT
- Raindrop
- GoldMax
- Sibot
- GoldFinder
- Sliver
- EnvyScout
- BoomBox
- VaporRage
- NativeZone
- FoggyWeb
- AADInternals
- TrailBlazer
- ROADTools
- QUIETEXIT
- reGeorg
Principal sources 150 reports
Ranked by how many of this actor's indicators each report brought in.
- 333x.com/blackorbird/status/1849713901807518125
- 333x.com/MichalKoczwara/status/18497384328236442…
- 333virustotal.com/gui/ip-address/162.252.175.146/relations
- 333app.validin.com/detail?find=151.236.16.138&type=ip4&ref…
- 333app.validin.com/detail?find=151.236.16.149&type=ip4&ref…
- 333app.validin.com/detail?find=151.236.16.193&type=ip4&ref…
- 333app.validin.com/detail?find=151.236.16.22&type=ip4&ref_…
- 333app.validin.com/detail?find=151.236.16.220&type=ip4&ref…
Related groups 5
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 1,088 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 1,088. Complete: G0016.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…
statistic-g.com -
x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…
domain m365-owa.com domain ms365-device.com domain ms365-live.com domain my-invite.org domain owa-ms365.com ipv4 104.194.159.150:443 ipv4 107.189.26.194:443 ipv4 138.197.202.81:3000 ipv4 138.68.160.124:3000 ipv4 165.22.146.161:3000 ipv4 213.145.86.112:443 ipv4 216.126.224.95:3000 ipv4 31.172.83.142:4000 ipv4 31.57.243.154:2000 ipv4 31.57.243.154:443 ipv4 38.146.28.132:443 ipv4 38.146.28.75:4000 ipv4 38.146.28.75:8443 ipv4 84.200.154.162:4000 url_path /t/pixel.gif?m= -
x.com/BlinkzSec/status/2008479066635039174 · x.com/banthisguy9349/status/20084907471344394…
rheinemetall.com -
research.checkpoint.com/2025/apt29-phishing-campaign
bakenhof.com bravecup.com info.ophibre.com mail.bakenhof.com mail.bravecup.com mail.ophibre.com mail.silry.com mx.ophibre.com ophibre.com silry.com -
aws.amazon.com/ru/blogs/security/amazon-disrupts-water…
cloudflare.redirectpartners.com findcloudflare.com redirectpartners.com -
x.com/ShanHolo/status/1887817002649047162 · app.validin.com/detail?find=185.243.99.17&type=ip4&ref_… · virustotal.com/gui/file/1916af4debbeaa0ee688c95d2d9d25… · virustotal.com/gui/file/7cfb5e14c49ed3c9425ae995a2f7f2…
domain ukrtelcom.com domain ukrtelecom.eu ipv4 185.243.99.17:3389 -
x.com/blackorbird/status/1868948019854643666 · trendmicro.com/en_no/research/24/l/earth-koshchei.html · trendmicro.com/content/dam/trendmicro/global/en/resear…
police-gov.cloud -
x.com/blackorbird/status/1868948019854643666 · trendmicro.com/en_no/research/24/l/earth-koshchei.html · trendmicro.com/content/dam/trendmicro/global/en/resear…
aeinc.solutions albrightstonebridge.cloud amazonmeeting.cloud americanprogress.cloud aspeninstitute.cloud awsmeetings.online c-r.services capgemini.services cepa.solutions citoc.cloud clari.cloud clearancejobs.cloud cnas.zone cwinc.cloud defence-au.cloud democracyendowment.cloud ecfr.cloud europa-eu.cloud exclaimer.solutions foreignpolicy.cloud freedomhouse.cloud gc-cloud.ca go-conference.cloud go-jp.cloud go-meet-up.com go-meet.pro go-meeting.cloud googlemeet.zone heritagecloud.org justice.technology mapn-ro.cloud mod-cloud.uk morh-hr.cloud mvep-hr.cloud ncsc.solutions ndu.solutions nrcc.cloud opensocietyfoundations.cloud prio.zone pulsesecure.cloud rrt.solutions rubrik.zone s3-aws.global s3-us.navy saiccloud.us shicloud.online sipacolumbia.us skykick.solutions softcat.cloud ssi-gouv-fr.cloud trustifi.cloud us-army.cloud veeam.solutions zixcorp.cloud zoom-meeting.cloud zoom-meeting.live zoom-meeting.pro zoom-meeting.today zoom-meetings.cloud zoommeeting.today zoommeeting.zone -
microsoft.com/en-us/security/blog/2024/10/29/midnight…
amazonsolutions.cloud ap-northeast-1-aws.s3-ua.cloud ap-northeast-1-aws.ukrainesec.cloud ca-central-1.gov-ua.cloud ca-central-1.ua-gov.cloud ca-west-1.aws-ukraine.cloud ca-west-1.ukrtelecom.cloud central-2-aws.ua-mil.cloud central-2-aws.ua-sec.cloud central-2-aws.ukrainesec.cloud central-2-aws.ukrtelecom.cloud dep-no.cloud eu-central-1-aws.amazonsolutions.cloud eu-central-1-aws.dep-no.cloud eu-central-1-aws.gov-pl.cloud eu-central-1-aws.gov-sk.cloud eu-central-1-aws.gov-trust.cloud eu-central-1-aws.minbuza.cloud eu-central-1-aws.mindef-nl.cloud eu-central-1-aws.msz-pl.cloud eu-central-1-aws.mzv-sk.cloud eu-central-1-aws.ncfta.cloud eu-central-1-aws.presidencia-pt.cloud eu-central-1-aws.quirinale.cloud eu-central-1-aws.regeringskansliet-se.cloud eu-central-1-aws.s3-be.cloud eu-central-1-aws.s3-ua.cloud eu-central-1-aws.ua-gov.cloud eu-central-1-aws.ukrainesec.cloud eu-central-1.difesa-it.cloud eu-central-1.mil-be.cloud eu-central-1.mil-pl.cloud eu-central-1.minbuza.cloud eu-central-1.mindef-nl.cloud eu-central-1.msz-pl.cloud eu-central-1.quirinale.cloud eu-central-1.regeringskansliet-se.cloud eu-central-1.s3-be.cloud eu-central-1.s3-esa.cloud eu-central-1.s3-nato.cloud eu-central-1.ua-gov.cloud eu-central-1.ua-sec.cloud eu-central-2-aws.amazonsolutions.cloud eu-central-2-aws.aws-ukraine.cloud eu-central-2-aws.dep-no.cloud eu-central-2-aws.gov-pl.cloud eu-central-2-aws.gov-sk.cloud eu-central-2-aws.mil-be.cloud eu-central-2-aws.mil-pl.cloud eu-central-2-aws.mindef-nl.cloud eu-central-2-aws.msz-pl.cloud eu-central-2-aws.mzv-sk.cloud eu-central-2-aws.presidencia-pt.cloud eu-central-2-aws.regeringskansliet-se.cloud eu-central-2-aws.s3-be.cloud eu-central-2-aws.ua-gov.cloud eu-central-2-aws.ua-mil.cloud eu-central-2-aws.ukrtelecom.cloud eu-east-1-aws.amazonsolutions.cloud eu-east-1-aws.dep-no.cloud eu-east-1-aws.gov-sk.cloud eu-east-1-aws.gov-ua.cloud eu-east-1-aws.mil-be.cloud eu-east-1-aws.mil-pl.cloud eu-east-1-aws.minbuza.cloud eu-east-1-aws.mindef-nl.cloud eu-east-1-aws.msz-pl.cloud eu-east-1-aws.mzv-sk.cloud eu-east-1-aws.quirinale.cloud eu-east-1-aws.regeringskansliet-se.cloud eu-east-1-aws.s3-be.cloud eu-east-1-aws.s3-de.cloud eu-east-1-aws.ua-gov.cloud eu-east-1-aws.ua-sec.cloud eu-east-1-aws.ukrtelecom.cloud eu-north-1-aws.dep-no.cloud eu-north-1-aws.difesa-it.cloud eu-north-1-aws.gov-pl.cloud eu-north-1-aws.gov-sk.cloud eu-north-1-aws.mil-be.cloud eu-north-1-aws.mil-pl.cloud eu-north-1-aws.minbuza.cloud eu-north-1-aws.ncfta.cloud eu-north-1-aws.presidencia-pt.cloud eu-north-1-aws.quirinale.cloud eu-north-1-aws.regeringskansliet-se.cloud eu-north-1-aws.s3-be.cloud eu-north-1-aws.s3-de.cloud eu-north-1.difesa-it.cloud eu-north-1.gov-trust.cloud eu-north-1.gov-ua.cloud eu-north-1.gv-at.cloud eu-north-1.mil-be.cloud eu-north-1.mil-pl.cloud eu-north-1.mzv-sk.cloud eu-north-1.ncfta.cloud eu-north-1.regeringskansliet-se.cloud eu-north-1.s3-be.cloud eu-north-1.s3-de.cloud eu-north-1.s3-ua.cloud eu-south-1-aws.admin-ch.cloud eu-south-1-aws.dep-no.cloud eu-south-1-aws.difesa-it.cloud eu-south-1-aws.gov-pl.cloud eu-south-1-aws.gov-trust.cloud eu-south-1-aws.mil-be.cloud eu-south-1-aws.minbuza.cloud eu-south-1-aws.mzv-sk.cloud eu-south-1-aws.quirinale.cloud eu-south-1-aws.s3-be.cloud eu-south-1-aws.s3-de.cloud eu-south-1-aws.ua-gov.cloud eu-south-2-aws.amazonsolutions.cloud eu-south-2-aws.dep-no.cloud eu-south-2-aws.gov-pl.cloud eu-south-2-aws.gov-sk.cloud eu-south-2-aws.mil-be.cloud eu-south-2-aws.mil-pl.cloud eu-south-2-aws.mil-pt.cloud eu-south-2-aws.minbuza.cloud eu-south-2-aws.msz-pl.cloud eu-south-2-aws.mzv-sk.cloud eu-south-2-aws.ncfta.cloud eu-south-2-aws.quirinale.cloud eu-south-2-aws.regeringskansliet-se.cloud eu-south-2-aws.s3-be.cloud eu-south-2-aws.s3-de.cloud eu-south-2-aws.s3-esa.cloud eu-south-2-aws.s3-nato.cloud eu-south-2-aws.s3-ua.cloud eu-south-2-aws.ua-gov.cloud eu-south-2.dep-no.cloud eu-south-2.gov-pl.cloud eu-south-2.gov-sk.cloud eu-south-2.mil-be.cloud eu-south-2.mil-pl.cloud eu-south-2.mindef-nl.cloud eu-south-2.s3-be.cloud eu-south-2.s3-de.cloud eu-south-2.s3-esa.cloud eu-south-2.s3-nato.cloud eu-south-2.ua-sec.cloud eu-south-2.ukrainesec.cloud eu-southeast-1-aws.amazonsolutions.cloud eu-southeast-1-aws.aws-ukraine.cloud eu-southeast-1-aws.dep-no.cloud eu-southeast-1-aws.difesa-it.cloud eu-southeast-1-aws.gov-sk.cloud eu-southeast-1-aws.gov-trust.cloud eu-southeast-1-aws.mil-be.cloud eu-southeast-1-aws.mil-pl.cloud eu-southeast-1-aws.mindef-nl.cloud eu-southeast-1-aws.msz-pl.cloud eu-southeast-1-aws.mzv-cz.cloud eu-southeast-1-aws.mzv-sk.cloud eu-southeast-1-aws.quirinale.cloud eu-southeast-1-aws.s3-be.cloud eu-southeast-1-aws.s3-de.cloud eu-southeast-1-aws.s3-esa.cloud eu-southeast-1-aws.s3-ua.cloud eu-southeast-1-aws.ua-energy.cloud eu-southeast-1-aws.ukrainesec.cloud eu-west-1-aws.amazonsolutions.cloud eu-west-1-aws.aws-ukraine.cloud eu-west-1-aws.dep-no.cloud eu-west-1-aws.gov-pl.cloud eu-west-1-aws.gov-sk.cloud eu-west-1-aws.gov-trust.cloud eu-west-1-aws.gov-ua.cloud eu-west-1-aws.mil-be.cloud eu-west-1-aws.mil-pl.cloud eu-west-1-aws.minbuza.cloud eu-west-1-aws.quirinale.cloud eu-west-1-aws.s3-be.cloud eu-west-1-aws.s3-de.cloud eu-west-1-aws.s3-esa.cloud eu-west-1-aws.s3-nato.cloud eu-west-1-aws.ua-sec.cloud eu-west-1-aws.ukrainesec.cloud eu-west-1.aws-ukraine.cloud eu-west-1.difesa-it.cloud eu-west-1.gov-sk.cloud eu-west-1.mil-be.cloud eu-west-1.mil-pl.cloud eu-west-1.minbuza.cloud eu-west-1.msz-pl.cloud eu-west-1.mzv-sk.cloud eu-west-1.regeringskansliet-se.cloud eu-west-1.s3-de.cloud eu-west-1.s3-esa.cloud eu-west-1.s3-ua.cloud eu-west-1.ua-gov.cloud eu-west-1.ukrtelecom.cloud eu-west-2-aws.amazonsolutions.cloud eu-west-2-aws.dep-no.cloud eu-west-2-aws.difesa-it.cloud eu-west-2-aws.gov-pl.cloud eu-west-2-aws.gov-sk.cloud eu-west-2-aws.gv-at.cloud eu-west-2-aws.mil-be.cloud · 70 more in this batch, in the JSON
Further reading 169
- secureworks.com/research/threat-profiles/iron-hemlock
- attack.mitre.org/groups/G0016
- labs.sentinelone.com/noblebaron-new-poisoned-installers-coul…
- learn.microsoft.com/en-us/microsoft-365/security/intelligen…
- media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_…
- msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity
- unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline
- crowdstrike.com/blog/bears-midst-intrusion-democratic-n…
- crowdstrike.com/blog/observations-from-the-stellarparti…
- crowdstrike.com/blog/sunspot-malware-technical-analysis
- f-secure.com/documents/996508/1030745/dukes_whitepap…
- fireeye.com/blog/threat-research/2018/11/not-so-coz…
- fireeye.com/blog/threat-research/2020/12/evasive-at…
- gov.uk/government/news/russia-uk-and-us-expose…
- gov.uk/government/news/russia-uk-exposes-russi…
- mandiant.com/resources/blog/unc3524-eye-spy-email
- microsoft.com/security/blog/2018/12/03/analysis-of-cy…
- microsoft.com/security/blog/2021/03/04/goldmax-goldfi…
- microsoft.com/security/blog/2021/05/27/new-sophistica…
- microsoft.com/security/blog/2021/05/28/breaking-down-…
- ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-v…
- ncsc.gov.uk/files/Advisory-further-TTPs-associated-…
- ncsc.gov.uk/news/uk-and-us-call-out-russia-for-sola…
- pwc.co.uk/issues/cyber-security-services/insights…
- pwc.co.uk/issues/cyber-security-services/insights…
- app.validin.com/detail?find=151.236.16.22&type=ip4&ref_…
- blog.truesec.com/2020/12/22/collaboration-between-fin7-a…
- virustotal.com/gui/ip-address/84.32.188.148/relations
- telsy.com/nobelium-again-or-ecrime-operation
- twitter.com/ShadowChasing1/status/13688317621140930…
- riskiq.com/blog/external-threat-management/apt29-b…
- twitter.com/h2jazi/status/1714986809229251067
- cert.gov.ua/article/6281076 (# UAC-0215)
- otx.alienvault.com/pulse/60b689c652cd41240e77cfbe
- twitter.com/JAMESWT_MHT/status/1545303433959411714
- twitter.com/joakimkennedy/status/1303626343830167552
- twitter.com/RedDrip7/status/1545245625662418945
- welivesecurity.com/wp-content/uploads/2019/10/ESET_Operati…
- crowdstrike.com/blog/observations-from-the-stellarparti…
- virustotal.com/gui/file/85e72976b9448295034a8d4c26462b…
129 more, and the report behind every indicator, in G0016.json.