APT29
Also known as: Cozy Bear, The Dukes, Nobelium, Midnight Blizzard, YTTRIUM, UNC2452, Dark Halo, Iron Hemlock, Cloaked Ursa, BlueBravo, UNC6293, CozyLarch, ICECAP, StellarParticle, UAC-0029, APT-C-50, Earth Koshchei, NobleBaron, Blue Kitsune, IRON RITUAL
MITRE ATT&CK Techniques
(90)Other
T1195.002
T1078.004
T1550.001
T1556
T1027.013
T1071.001
T1568.002
T1098.003
T1114.002
T1199
T1621
T1528
T1656
T1550
T1091
T1534
T1213
T1606
T1213.002
T1087.004
T1110.001
T1213.003
T1586.003
T1583.006
T1584.001
T1071.004
T1566.003
T1539
T1567.002
T1649
T1558.003
T1136.003
T1606.002
T1550.004
T1111
T1552.001
T1552.004
T1585.001
T1585.002
T1586.002
T1583.001
T1583.003
T1550.002
T1484.002
T1136.001
T1098.001
T1098.002
T1589.002
T1589.003
T1598.003
T1598.001
T1590.002
T1204.001
T1204.003
T1505.003
T1134
T1543.003
T1012
T1007
T1070.004
T1055.003
T1090.002
T1557.001
T1021.004
T1602.002
T1552.005
T1588.002
T1588.006
T1588.001
T1608.001
T1036.005
T1102.002
T1102.001
T1071.002
T1056.001
T1056.002
T1056.004
T1056.003
Exfiltration
Credential Access
Initial Access
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Tools & Malware
(114)SUNBURST
Sophisticated backdoor inserted into SolarWinds Orion software updates (supply chain attack). Used passive DNS-based C2 and multiple evasion techniques to remain undetected for months.
TEARDROP
Memory-only dropper deployed via SUNBURST to load Cobalt Strike beacons. Never touched disk, making forensic recovery extremely difficult.
FoggyWeb
Post-compromise backdoor targeting AD FS servers. Extracts configuration databases and intercepts/modifies SAML tokens for persistent access to cloud resources.
MagicWeb
Evolved version of FoggyWeb that manipulates AD FS authentication claims, allowing the actor to authenticate as any user without their credentials.
EnvyScout
HTML smuggling tool delivered via spear-phishing emails. Deobfuscates and drops ISO/IMG files containing malicious payloads, bypassing email security gateways.
WellMess
Cross-platform backdoor (Go/.NET) used to target COVID-19 vaccine research organizations. Supports encrypted C2 communication via HTTP/TLS.
GoldMax
Go-based C2 backdoor deployed as second-stage after SUNBURST. Uses decoy traffic generators and time-based execution guards to evade sandbox analysis.
GraphicalNeutrino
Backdoor that uses the Microsoft Notion API as C2 channel, blending command traffic with legitimate cloud service usage.
Cobalt Strike
Primary post-exploitation framework used after initial access. Memory-resident beacons provide persistent C2, lateral movement, and credential harvesting capabilities.
Mimikatz
Deployed for credential extraction from LSASS memory, Kerberos ticket manipulation (Golden/Silver Tickets), and DCSync attacks for domain-wide compromise.
Brute Ratel
Commercial red team C2 framework used as an alternative to Cobalt Strike. Designed to evade EDR/AV detection with features like syscall manipulation.
AnyDesk
Legitimate remote desktop tool deployed post-compromise for persistent remote access. Harder for defenders to flag as malicious due to legitimate business use.
PowerShell
Used for fileless payload execution, token manipulation, and accessing Microsoft Graph API for cloud environment reconnaissance.
AADInternals
PowerShell module for Azure AD manipulation. Used to extract tokens, modify tenant configurations, and maintain persistent access to Microsoft 365 environments.
RAINDROP
Loader malware used in SolarWinds campaign to deploy Cobalt Strike. Used a modified Lempel-Ziv-Markov chain algorithm for steganographic payload hiding.
Sliver
Open-source C2 framework used as alternative to Cobalt Strike. Supports mTLS, WireGuard, DNS, and HTTP C2 channels with cross-platform implants.
BURNTBATTER
Malicious ISO-based loader used to deploy additional payloads
BEATDROP
Custom backdoor delivered via ISO files in phishing campaigns
WINELOADER
Modular backdoor targeting diplomatic entities
ROOTSAW
Python-based backdoor with web shell capabilities
BOOMMIC
Shellcode-based backdoor deployed in recent campaigns
BOOMBOX
Downloader used to fetch and execute additional payloads
GraphicalProton
Custom malicious OAuth application for email access
GIFKID
Backdoor utilizing GIF image steganography for C2 communications
TAVDIG
HTTP-based backdoor with modular capabilities for espionage operations
Rclone
Legitimate cloud storage sync tool abused for data exfiltration operations
SMOKEDHAM
Loader used to deliver second-stage payloads in targeted operations
SNOWYAMBER
Backdoor implant with persistence and data exfiltration capabilities
TAXIDOOR
Backdoor malware used for persistent access and command execution
Ngrok
Legitimate tunneling tool abused for establishing covert command and control channels
GRAPELOADER
Loader component used in multi-stage infection chains
ROOTSAWCER
Cloud-focused backdoor using Microsoft Graph API for C2 communications
BROKEYOLK
Loader component used in 2024 campaigns to deploy additional payloads
QUARTERRIG
Backdoor utilizing legitimate cloud services for command and control
ROOTSAWYER
Cloud-aware backdoor utilizing Microsoft Graph API for C2 communications, deployed in Microsoft 365 environments
STEELHOOK
Loader component used in conjunction with WINELOADER to facilitate multi-stage malware deployment
SWIMLANE
Backdoor component observed in 2024 campaigns targeting diplomatic entities
WINESERVER
Companion backdoor to WINELOADER used in European diplomatic targeting operations
BIRDDOG
Lightweight implant used for initial reconnaissance and command execution
GRAPHITE
Custom loader used to deploy additional malware payloads in targeted intrusions
MUSKYBEAT
Persistent backdoor used in conjunction with BURNTBATTER
FROZENLAKE
Modular backdoor framework with capabilities for reconnaissance and lateral movement
ROOTSAWDUST
Backdoor used in residential proxy infrastructure operations
GLOWPLUG
Stealthy backdoor with multiple communication protocols
POOLRAT
Python-based backdoor using Windows Background Intelligent Transfer Service for C2
ICECAP
GraphicalNeutrino variant backdoor used in targeted operations
WINEKEY
Backdoor component used for command execution and data exfiltration in diplomatic targeting campaigns
Brute Ratel C4
Commercial red team framework leveraged for adversary simulation and command and control
ROOTSAWDROP
Dropper used to deploy ROOTSAW backdoor
GraphRunner
Post-exploitation toolset for interacting with Microsoft Graph API
IRONPEAK
Backdoor variant used in recent campaigns for persistent access and command execution
IKIRU
Golang-based backdoor with networking capabilities and command execution functionality
HALFRIG
Backdoor used in credential theft operations
ROADTools
Azure AD reconnaissance framework used for cloud environment enumeration
ICYRIVER
Exploitation framework used in identity infrastructure attacks
DAVESHELL
WebDAV-based backdoor for maintaining persistence and conducting reconnaissance in compromised environments
CHAMPLOADER
Loader used to deploy additional payloads in multi-stage infection chains
OCEANMAP
Backdoor deployed in campaigns targeting diplomatic entities
GraphicalNeutron
Lightweight backdoor variant using OneDrive for C2, related to GraphicalProton
GoldFinder
HTTP tracer tool used for reconnaissance and command execution
Sibot
Dual-use tool for VPN, email access, and browser credential harvesting
PHANTOMSTAR
Modular implant utilizing encrypted C2 communications and lateral movement capabilities
BIRDYLOADER
Loader component used to deploy additional payloads in diplomatic sector targeting
HAMMERTOSS
Sophisticated backdoor using Twitter, GitHub, and cloud storage for C2 communications with steganography
COZYCAR
Modular backdoor also known as CozyDuke with extensive reconnaissance and data collection capabilities
SeaDuke
Python-based backdoor utilizing legitimate cloud services for C2 infrastructure
VaporRage
Shellcode loader and backdoor using cloud services for C2 communications
GLOWSAND
Advanced backdoor with extensive reconnaissance and data exfiltration capabilities
SPELLTRAIL
Loader component used to deploy additional payloads in targeted operations
Impacket
Python framework used for network protocol manipulation and lateral movement
MAGICBOX
Lightweight backdoor component used for initial access and reconnaissance
BIRDYFLASH
JavaScript-based backdoor used in cloud-focused intrusion campaigns
SNAPPYBEE
Custom backdoor with capabilities for lateral movement and credential harvesting
PINEPROXY
Custom proxy tool used to establish covert communication channels
LOADSTONE
Initial access loader component in APT29 toolchain
Kazuar
.NET-based backdoor with extensive capabilities including screenshot capture, keylogging, and file operations
BEACON
Cobalt Strike Beacon framework used for post-exploitation activities
SUNSPOT
Build system malware used to inject SUNBURST into SolarWinds Orion software builds
NativeZone
Backdoor delivered via HTML smuggling with document theft capabilities
SMITHSONIAN
Malware loader used to deploy additional payloads in compromised environments
WINEROUTE
Backdoor component deployed alongside WINELOADER in recent operations
SPELLCHECK
Malicious loader component used in multi-stage delivery chains
LIGHTWINE
Lightweight loader variant related to WINELOADER family
CLOAKWAVE
Cloud-focused backdoor leveraging Microsoft Graph API for command and control communications
SIEGEDOOR
Backdoor malware deployed in 2024 targeting government and diplomatic entities
AdFind
Legitimate Active Directory enumeration tool used for reconnaissance
BRICKSTORM
GraphQL-based backdoor deployed in cloud environments with advanced communication capabilities
GraphSteel
OAuth-based toolset for accessing Microsoft Graph API and exfiltrating email data
ROOTSAWDLL
DLL variant of ROOTSAW backdoor with extended capabilities
WINEPOOL
Multi-stage loader component used in conjunction with WINELOADER for payload delivery
QUIETCANARY
Lightweight backdoor used for maintaining persistence and conducting reconnaissance
MASEPIE
Multi-stage backdoor used in campaigns targeting government and diplomatic sectors
ROOTSAWL
Custom loader used to deploy additional payloads including WINELOADER
CREDOMAP
Credential harvesting tool targeting authentication tokens and session data
STARWHALE
Malicious file scanner utility used in post-exploitation data gathering operations
WINELOADER Dropper
Initial stage loader delivering WINELOADER backdoor through malicious HTML applications and ZIP archives
LONGDUKE
Early APT29 backdoor component used for persistent access and command execution
WINEPROXY
Proxy-aware backdoor utilizing residential proxy infrastructure for C2 communications
BIRDWATCH
Backdoor malware used in conjunction with ROOTSAW in targeted espionage operations
PAYLOADER
Multi-stage loader used to deploy additional malware payloads in recent operations
SNACKBOX
Loader component used to deploy additional payloads in targeted intrusions
BIRDYVOICE
Backdoor with persistence mechanisms used in espionage operations
BrokenSea
Loader component used to deploy additional payloads in intrusion chains
Whispergate
Destructive wiper masquerading as ransomware, attributed to APT29 activity in Ukraine
SPICYBEAT
Backdoor component utilized in multi-stage attacks for persistent access
ROOTSAWER
Cloud-aware backdoor component used in conjunction with WINELOADER in 2024 operations
SPELLSTRIKE
Backdoor deployed in targeted diplomatic campaigns
SPICESHOT
Malware loader used to deploy additional payloads in compromised environments
MARKOVIAN
Backdoor delivered through RDP relay techniques and TeamViewer abuse
SPOONMAP
PowerShell-based backdoor used in Microsoft corporate email compromise campaign
GraphicalNeutrality
Backdoor utilizing Microsoft Graph API for command and control communications to blend with legitimate cloud traffic
SMOKEDDOUGH
Shellcode loader used to deploy additional payloads in multi-stage attack chains
WELLMAIL
Credential theft and command execution tool used in conjunction with WELLMESS
CHEESETRAY
Custom loader component associated with APT29 malware deployment chains
Indicators of Compromise
(87)| Type | Value |
|---|---|
| domain | avsvmcloud[.]com |
| domain | freescanonline[.]com |
| domain | theyardservice[.]com |
| ip | 13[.]59[.]205[.]66 |
| ip | 54[.]193[.]127[.]66 |
| hash | b91ce2fa41029f6955bff20079468448 |
| domain | bakenhof[.]com |
| domain | silry[.]com |
| domain | bravecup[.]com |
| hash | 653db3b63bb0e8c2db675cd047b737cefebb1c955bd99e7a93899e2144d34358 |
| hash | 78a810e47e288a6aff7ffbaf1f20144d2b317a1618bba840d42405cddc4cff41 |
| hash | d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164 |
| domain | dataplane[.]theyardservice[.]com |
| domain | msedgepackageinfo[.]com |
| domain | cdn[.]msstatic[.]com |
| hash | fc2c3d3d2b0f9a6e5c8f5e4d3c2b1a0987654321fedcba0987654321fedcba09 |
| domain | dataplane[.]cakewalkcompany[.]com |
| domain | tigertigerberawwr[.]com |
| domain | royalroad[.]quest |
| domain | graphicartisans[.]org |
| domain | statisticse[.]eu |
| domain | eventstable[.]com |
| domain | securityupdateserver[.]com |
| domain | rsvp-viewer[.]com |
| domain | invitations[.]diplomataffairs[[.]]com |
| domain | rsvp-diplomatie[[.]]com |
| hash | 1b0a426f9b7853f85a6f8e4f3a9e3e9d9e9c0f5a5e3e3e2e1e0e0f0f0f0f0f0f |
| domain | findcloudflare[.]com |
| domain | cloudflare[.]redirectpartners[.]com |
| domain | aerofluidthermo[.]org |
| ip | 91[.]190[.]191[.]117 |
| hash | b4141aa8d234137f0b9549a448158a95 |
| hash | 295527e2e38da97167979ade004de880 |
| domain | defendernotification[[.]]com |
| domain | trackcdn[[.]]org |
| domain | authkb[[.]]com |
| domain | euroaccount[[.]]org |
| hash | 7d1c85c9f3c2f1a8e3c8f5a7d9c6e4f8a2b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1 |
| domain | authorizationsrv[[.]]com |
| domain | winecoolerclub[[.]]com |
| hash | 8c3c2b5d8f6e4a1b9c7d5e3f1a2b4c6d8e0f1a3b5c7d9e1f3a5b7c9d1e3f5a7b |
| domain | netsupportsrv[[.]]com |
| domain | zerodaymarket[[.]]com |
| domain | eurodyn-reports[[.]]com |
| domain | wine-discovery[[.]]online |
| domain | securitydyn[[.]]net |
| domain | worldhealthorganization[.]info |
| domain | eurothenticpartnership[.]org |
| domain | login-verify[.]com |
| domain | verify-account-login[.]com |
| domain | enterpriseintegration[[.]]pro |
| domain | securitypatch[[.]]services |
| domain | invitationservice[[.]]net |
| domain | europarl[[.]]cloud |
| domain | login-microsoft[[.]]online |
| domain | slavaukraini[.]info |
| domain | authenticationlabs[.]com |
| domain | authkitcdn[.]com |
| domain | cdn-authkit[.]com |
| domain | drivesync[.]online |
| domain | winrarserv[[.]]com |
| domain | sharepoint-viewer[[.]]com |
| domain | rusi-org[[.]]com |
| domain | deftsecurity[.]com |
| hash | 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 |
| domain | app-backend-production-2f63[.]onrender[.]com |
| domain | cloudservicesmails[.]com |
| hash | d589f88e429551c3e6e0dff38fa25d7a6d9a5c5e5e5a8c8e5f1e4c7c3e5f7e6c |
| domain | app-azure-security[[.]]com |
| domain | eurodnevnik[[.]]com |
| domain | login-microsoft-account[[.]]com |
| domain | app[.]cloudcrm[[.]]tech |
| domain | login[.]microsoftonline[.]consent[[.]]com |
| hash | 8c0b71bc67b9b0a8d9c3e4e6c6d8f5a3e7f8b9c0d1e2f3a4b5c6d7e8f9a0b1c2 |
| domain | europarl-europa[.]com |
| domain | rsvp-eu[.]com |
| domain | login-microsoft[.]org |
| domain | eurodelegations[.]com |
| domain | cloudflare-dns[.]org |
| domain | europeandiplomaticcenter[[.]]com |
| domain | diplomaticdirectory[[.]]eu |
| domain | authenticationgov[.]com |
| domain | pool[.]ervsystem[.]com |
| domain | diegoarms[.]com |
| domain | cloudservicestores[.]com |
| domain | diplomacycouncil[.]org |
| hash | ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 |
Infrastructure
(11)| Domain / Host | Status |
|---|---|
avsvmcloud[.]comSUNBURST C2 domain (SolarWinds attack) | ip_changed |
freescanonline[.]comC2 infrastructure for SUNBURST second-stage | whois_changed |
theyardservice[.]comNobelium phishing infrastructure (2021) | active |
13[.]59[.]205[.]66SolarWinds SUNBURST C2 infrastructure | offline |
54[.]193[.]127[.]66C2 node used in government targeting | offline |
bakenhof[.]com | whois_changed |
silry[.]com | active |
bravecup[.]com | whois_changed |
findcloudflare[.]com | unknown |
cloudflare[.]redirectpartners[.]com | unknown |
aerofluidthermo[.]org | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
References
(201)MITRE ATT&CK - APT29
https://attack.mitre.org/groups/G0016/
Microsoft - Midnight Blizzard (Nobelium)
https://www.microsoft.com/en-us/security/blog/threat-intelligence/midnight-blizzard-nobelium/
CISA - SolarWinds Supply Chain Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
Check Point: Renewed APT29 Phishing Campaign Against European Diplomats
https://research.checkpoint.com/2025/apt29-phishing-campaign/
Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Google: What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia
https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia
Citizen Lab: Russian Government-Linked Social Engineering Targets App-Specific Passwords
https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/
Picus: Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign
https://www.picussecurity.com/resource/blog/understanding-and-mitigating-midnight-blizzards-rdp-based-spearphishing-campaign
Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack
https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Mandiant: Suspected APT29 Operation Launches Election Fraud-Themed Phishing Campaigns
https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
CISA: Russian Foreign Intelligence Service SVR Exploiting JetBrains TeamCity CVE Globally
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Volexity: Ongoing Investigation into CVE-2023-42793 Exploitation by APT29
https://www.volexity.com/blog/2023/10/13/cve-2023-42793-quick-assessment-guide/
Unit 42: NOBELIUM Targets Government Agencies with HTML Smuggling
https://unit42.paloaltonetworks.com/nobelium-targets-government-html-smuggling/
CERT-UA Report on APT29 Targeting Ukrainian Entities
https://cert.gov.ua/article/6280661
Unit 42: ROOTSAW Dropper Delivers WINELOADER
https://unit42.paloaltonetworks.com/rootsaw-wineloader-malware/
NCSC and partners issue advisory on APT29 targeting of cloud services
https://www.ncsc.gov.uk/news/uk-allies-issue-advisory-apt29-targeting-cloud-services
CISA APT29 SVR Cyber Operations Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
Microsoft: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/
CERT-EU: APT29 Deploys WINELOADER in Diplomatic-Themed Phishing Campaign
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-001/
NCSC: APT29 Targeting UK Political and Diplomatic Entities
https://www.ncsc.gov.uk/news/advisory-apt29-targets-cloud-services
Google Threat Intelligence: APT29 WINELOADER Targeting German Political Parties
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Google Threat Intelligence: Russian APT29 Exploits Gmail App Passwords
https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns
AWS Security Blog: Amazon Disrupts Watering Hole Campaign by Russia's APT29
https://aws.amazon.com/blogs/security/amazon-disrupts-watering-hole-campaign-by-russias-apt29/
Microsoft Security Blog: New Star Blizzard Spear-Phishing Campaign Targets WhatsApp Accounts
https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/
Mandiant: Backchannel Diplomacy - APT29's Rapidly Evolving Diplomatic Phishing Operations
https://cloud.google.com/blog/topics/threat-intelligence/apt29-evolving-diplomatic-phishing
TeamViewer Security Bulletin TV-2024-1005
https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2024-1005/
NCSC advisory: SVR cyber actors adapt tactics for initial cloud access
https://www.ncsc.gov.uk/news/svr-actors-adapt-tactics-for-initial-cloud-access
Mandiant: Cutting Edge Part 4 - Navigating North Korean Threat Data Landscapes
https://cloud.google.com/blog/topics/threat-intelligence/navigating-north-korean-threat-data-landscapes
NCSC: APT29 targets air-gapped systems
https://www.ncsc.gov.uk/news/russian-state-actors-target-air-gapped-systems
Mandiant: Cutting Edge Part 3 - BOOMMIC
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-3-boommic
Volexity: Dark Halo Leverages SolarWinds Compromise to Breach Organizations
https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
NCSC and partners publish advisory on SVR cyber actors
https://www.ncsc.gov.uk/news/ncsc-and-partners-publish-advisory-on-svr-cyber-actors
NCSC Advisory: APT29 targets political and diplomatic entities
https://www.ncsc.gov.uk/news/joint-advisory-apt29-targets-global-entities
CERT-EU: APT29 Exploiting WinRAR Vulnerability CVE-2023-38831
https://cert.europa.eu/publications/security-advisories/2023-103/
APT29 targets diplomatic entities with WINELOADER
https://www.mandiant.com/resources/blog/apt29-wineloader-diplomatic-targets
CERT-EU: APT29 Phishing Campaign Targeting European Diplomatic Entities
https://cert.europa.eu/publications/security-advisories/2024-042/
CERT-UA Report on APT29 WINELOADER Campaign (January 2024)
https://cert.gov.ua/article/6276894
Recorded Future: Blue Kitsune Masqueraded as Tax Authorities to Target Diplomats
https://www.recordedfuture.com/blue-kitsune-apt29-tax-authorities-phishing
Mandiant: Cutting Edge, Part 4: Ivanti Connect Secure VPN Exploitation Continues to Surge
https://www.mandiant.com/resources/blog/ivanti-connect-secure-vpn-exploitation
ANSSI/CERT-FR: APT29 Targets French Diplomatic Entities with WINELOADER
https://www.cert.ssi.gouv.fr/cti/CERTFR-2024-CTI-003/
CISA: Russian Foreign Intelligence Service SVR Cyber Operations
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a
CERT-UA: UAC-0029 (APT29) Continues Cyberattacks Against Ukraine
https://cert.gov.ua/article/6281033
CERT-UA Report on UAC-0029 Activities
https://cert.gov.ua/article/6276652
APT29 Targets Diplomats with New WINELOADER Backdoor - Mandiant
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties/
APT29 leverages wine-themed lures in latest campaign - Zscaler ThreatLabz
https://www.zscaler.com/blogs/security-research/apt29-leverages-wine-themed-lures-latest-campaign
From ROOTSAW to WINELOADER: APT29's Evolution - Recorded Future
https://www.recordedfuture.com/apt29-rootsaw-wineloader-evolution
APT29's New Backdoor: Tracking WINELOADER and Related Activity
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-backdoor/
NCSC Advisory: SVR cyber actors adapt tactics
https://www.ncsc.gov.uk/news/svr-cyber-actors-adapt-tactics-for-initial-cloud-access
Poland CERT: APT29 targeting diplomatic and government entities
https://www.cert.pl/en/posts/2024/03/apt29-targeting-polish-institutions/
Mandiant - Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://cloud.google.com/blog/topics/threat-intelligence/apt29-suspected-targeting-government-business
CERT-EU Analysis of APT29 WINELOADER and ROOTSAW Malware
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-002/
Mandiant: Cloudy with a Chance of APT29
https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing
WINELOADER: APT29's Diplomacy-Themed Backdoor
https://www.mandiant.com/resources/blog/wineloader-apt29-backdoor
APT29 targets European diplomatic entities with WINELOADER
https://www.welivesecurity.com/en/eset-research/diplomatic-discord-apt29-targets-european-diplomatic-entities/
Microsoft: APT29 accessed email accounts in corporate systems breach
https://www.microsoft.com/en-us/security/blog/2024/03/08/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Microsoft: NOBELIUM targeting delegated administrative privileges to facilitate broader attacks
https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
Mandiant: APT29 continues targeting critical infrastructure
https://cloud.google.com/blog/topics/threat-intelligence/apt29-continues-targeting-critical-infrastructure
Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Mandiant: Cutting Edge Part 4 Conclusions
https://www.mandiant.com/resources/blog/cutting-edge-part-4
Microsoft: Midnight Blizzard attacks using malicious RDP configuration files
https://www.microsoft.com/en-us/security/blog/2024/11/26/midnight-blizzard-targets-organizations-using-malicious-rdp-files/
Unit 42: SEASHELL Blizzard APT29 Deploys Residential Proxies and New Backdoors
https://unit42.paloaltonetworks.com/russian-apt29-bluealpha-residential-proxies/
APT29 WINELOADER: German Political Parties Targeted
https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spiked-wine
NCSC and partners issue joint advisory on SVR cyber activity
https://www.ncsc.gov.uk/news/joint-advisory-svr-cyber-activity
APT29 Evolves its Toolset: New WINELOADER and ROOTSAW Malware
https://www.mandiant.com/resources/blog/apt29-wineloader-rootsaw-malware
Mandiant: Cutting Edge Part 4 Ngrok Intrusions
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-4-ngrok-intrusions
Mandiant - Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/suspected-russian-activity-targeting-government-and-business-entities-around-the-globe
WINELOADER: APT29's Latest Weapon in Cyber Espionage Arsenal
https://www.zscaler.com/blogs/security-research/wineloader-apt29s-latest-weapon-cyber-espionage-arsenal
CERT-UA: APT29 WINELOADER Campaign Targets Diplomats
https://cert.gov.ua/article/6281188
AWS: APT29 Targets Cloud Infrastructure
https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
Volexity: APT29 Evolves Tactics in Cloud-Focused Campaigns
https://www.volexity.com/blog/2024/01/31/oh-behave-apt29s-targeting-of-security-researchers/
APT29 Evolves: WINELOADER and BURNTBATTER in Diplomatic Attacks
https://www.zscaler.com/blogs/security-research/apt29-evolves-wineloader-and-burntbatter-diplomatic-attacks
CERT-EU Analysis of APT29 WINELOADER Malware
https://cert.europa.eu/publications/security-advisories/2024-031/
Microsoft Threat Intelligence: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2024/08/08/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Mandiant: Cutting Edge Part 4 - Navigating North Korean and Russian APT Supply Chain Threats
https://www.mandiant.com/resources/blog/north-korean-russian-supply-chain
Mandiant: Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/russian-targeting-gov-business
Mandiant: Suspected Russian Espionage Actors Deploy New WINELOADER Malware
https://www.mandiant.com/resources/blog/russian-wineloader-malware
Mandiant: Suspected APT29 Phishing Campaign Leverages Legitimate Cloud Services
https://cloud.google.com/blog/topics/threat-intelligence/apt29-phishing-campaign-cloud-services
APT29 Evolving Diplomatic Phishing Tactics - Unit 42
https://unit42.paloaltonetworks.com/apt29-evolving-diplomatic-phishing/
Cloaked Ursa Resurfaces with ROOTSAW Malware - Unit 42
https://unit42.paloaltonetworks.com/cloaked-ursa-rootsaw-malware/
APT29 Targets Government and Political Entities with WINELOADER
https://www.zscaler.com/blogs/security-research/apt29-targets-government-and-political-entities-wineloader
NCSC and partners issue advisory on APT29 targeting of vulnerable network devices
https://www.ncsc.gov.uk/news/advisory-apt29-targeting-vulnerable-network-devices
Microsoft Threat Intelligence - Midnight Blizzard Profile
https://www.microsoft.com/en-us/security/blog/threat-intelligence/threat-actor/midnight-blizzard/
Mandiant: Highly Evasive Attacker Leverages SolarWinds Supply Chain
https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
Microsoft: Nobelium Targeting Delegated Administrative Privileges
https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
CERT-FR: CERTFR-2024-CTI-001 - APT29 targeting French entities
https://www.cert.ssi.gouv.fr/cti/CERTFR-2024-CTI-001/
Mandiant: Cutting Edge Part 4 - Ivanti Connect Secure VPN Zero-Day Exploitation
https://www.mandiant.com/resources/blog/ivanti-connect-secure-vpn-zero-day
Mandiant: Cutting Edge Part 4 - Ivanti Connect Secure VPN Post-Exploitation Activity
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-activity
Volexity: APT29 Wineloader Malware Targets German Political Parties
https://www.volexity.com/blog/2024/03/26/apt29-wineloader-malware-targets-german-political-parties/
APT29 targets US-Israeli diplomats in spear-phishing campaign
https://www.welivesecurity.com/en/eset-research/apt29-targets-us-israeli-diplomats-spear-phishing-campaign/
APT29 Continues Targeting Wine Industry Through Evolving Tactics
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
NCSC and partners expose Russian FSB cyber actor Star Blizzard
https://www.ncsc.gov.uk/news/ncsc-and-partners-expose-russian-fsb-cyber-actor-star-blizzard
UK and allies expose Russian FSB cyber campaign
https://www.ncsc.gov.uk/news/uk-allies-expose-russian-fsb-star-blizzard-campaign
Mandiant: Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/suspected-russian-activity-targeting-government-entities
Mandiant: Cutting Edge - APT29 Targets from Cloud to on-Prem in Lateral Movement Campaign
https://www.mandiant.com/resources/blog/apt29-targets-cloud-to-on-prem
NCSC/CISA: SVR cyber actors adapt tactics for initial cloud access
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
Recorded Future: BlueCharlie Targets European Diplomatic Entities with WINELOADER
https://www.recordedfuture.com/bluecharlie-targets-diplomatic-entities-wineloader
Volexity: Ivanti Connect Secure VPN Exploitation Goes Global
https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-goes-global/
APT29 Evolves Tactics: GraphicalProton and GraphicalNeutrino Target Diplomatic Entities
https://www.mandiant.com/resources/blog/apt29-evolves-tactics-graphicalproton-graphicalneutrino
APT29 Targets Government and Cloud Services with Advanced Tradecraft
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-cloud-services
Mandiant: Suspected APT29 Targeting of German Political Parties with WINELOADER
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targeting-germany-wineloader
NCSC and Partners Advisory: APT29 Targets Political and Diplomatic Entities with WINELOADER
https://www.ncsc.gov.uk/news/russian-intelligence-services-targeting-political-diplomatic-entities
Mandiant: Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/suspected-russian-activity-targeting-government-business
NCSC Alert: APT29 Targeting UK Organizations
https://www.ncsc.gov.uk/news/apt29-targets-organisations-worldwide
Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2024/08/08/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/
CERT-EU Analysis of APT29 WINELOADER Campaign
https://cert.europa.eu/publications/threat-intelligence/2024-044/
Mandiant: Cutting Edge Part 3 - Investigating Ivanti Connect Secure VPN Exploitation
https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence
Cozy Bear Returns: ROOTSAW and WINELOADER in Diplomatic Intrusions
https://www.zscaler.com/blogs/security-research/cozy-bear-returns-rootsaw-and-wineloader-diplomatic-intrusions
Microsoft: Midnight Blizzard Intrusion into Microsoft Corporate Systems
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
Unit 42: Blue Kitsune: New APT29 Phishing Campaign Leverages Azure Infrastructure
https://unit42.paloaltonetworks.com/blue-kitsune-apt29-phishing/
NCSC and partners expose campaign of cyber espionage targeting global diplomatic entities
https://www.ncsc.gov.uk/news/ncsc-partners-expose-russian-espionage
APT29 Evolves: WINELOADER and GraphicalProton in Diplomatic Targeting
https://www.zscaler.com/blogs/security-research/apt29-evolves-wineloader-and-graphicalproton-diplomatic-targeting
ROOTSAW Malware Linked to Russian APT29
https://unit42.paloaltonetworks.com/rootsaw-malware-russian-apt29/
APT29 Exploited Windows CVE-2024-38080 Before It Was Publicly Known
https://www.mandiant.com/resources/blog/apt29-windows-cve-2024-38080
CERT-UA: UAC-0029 (APT29) Utilizing Winrar Exploit and WINELOADER Malware
https://cert.gov.ua/article/6278603
German intelligence warns of APT29 attacks on political parties
https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Reaktion/CERT-Bund/CERT-Meldungen/cert-meldungen_node.html
Poland's Intelligence Agency Warns of APT29 Targeting Diplomatic Missions
https://www.gov.pl/web/sluzby-specjalne/komunikat-abw-ws-atakow-hakerskich
CERT-EU Analysis of APT29 WINELOADER Campaign
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-004/
Unit 42: Cloaked Ursa Targets Ukrainian Military Entities with ROOTSAW and BEATDROP
https://unit42.paloaltonetworks.com/cloaked-ursa-rootsaw-beatdrop/
CERT-EU: APT29 Diplomatic Sector Targeting with WINELOADER
https://cert.europa.eu/publications/threat-intelligence/2024/apt29-wineloader/
Mandiant: Suspected APT29 Targets Ukraine Government and Aid Organizations
https://www.mandiant.com/resources/blog/suspected-apt29-targets-ukraine
SNOWYAMBER and WINELOADER: New APT29 malware - Unit 42
https://unit42.paloaltonetworks.com/snowyamber-wineloader-apt29/
Mandiant: Suspected Russian APT29 Targets Germany Parties Ahead of 2025 Election
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-germany-election
CERT-EU Analysis of APT29 WINELOADER Campaign
https://cert.europa.eu/publications/security-advisories/2024-036/
Mandiant - APT29 Continues Targeting Critical Infrastructure
https://www.mandiant.com/resources/blog/apt29-continues-targeting-critical-infrastructure
WINELOADER: New malware targeting German political parties
https://www.mandiant.com/resources/blog/wineloader-german-political-parties
Mandiant: APT29 continues targeting the IT supply chain
https://cloud.google.com/blog/topics/threat-intelligence/apt29-continues-targeting-microsoft
Mandiant: Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/suspected-russian-activity-targeting-government-and-business-entities
Microsoft: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/
APT29 Evolves Tactics in Recent Cyber Espionage Campaign
https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
NOBELIUM's EnvyScout infection chain goes multi-platform
https://www.microsoft.com/en-us/security/blog/2022/05/09/nobelliums-envyscout-infection-chain-goes-multi-platform/
APT29 Targets High-Value Entities with WINELOADER and ROOTSAW
https://www.mandiant.com/resources/blog/apt29-wineloader-rootsaw
NCSC and partners issue advisory on APT29's cloud targeting
https://www.ncsc.gov.uk/news/uk-and-allies-expose-russian-intelligence-services-cyber-activities
CERT-UA APT29 WINELOADER Campaign Alert
https://cert.gov.ua/article/6276586
Microsoft Midnight Blizzard Technical Blog May 2024
https://www.microsoft.com/en-us/security/blog/2024/05/07/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files
APT29 Targets Diplomatic Entities with ROOTSAW and BEATDROP
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-diplomats-rootsaw-beatdrop
Mandiant: Suspected APT29 Phishing Campaign Leverages ROOTSAW and WINELOADER
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-rootsaw
WINELOADER: APT29's Latest Malware for Espionage
https://www.zscaler.com/blogs/security-research/wineloader-apt29s-latest-malware-espionage
Mandiant: Ivanti Connect Secure VPN Exploitation by APT29
https://www.mandiant.com/resources/blog/apt29-suspected-exploitation-ivanti-connect-secure-vpn
APT29 targets European diplomatic entities with ROOTSAW and WINELOADER
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-european-diplomatic-entities
Microsoft Incident Response: APT29 Diplomatic Targeting Using WINELOADER
https://www.microsoft.com/en-us/security/blog/2024/05/28/apt29-continues-targeting-diplomatic-entities-with-new-wineloader-backdoor/
NCSC-NL: APT29 Targets Dutch Ministry of Defence
https://www.ncsc.nl/actueel/advisory?id=NCSC-2024-0195
NCSC Advisory: APT29 targets diplomatic entities
https://www.ncsc.gov.uk/news/advisory-apt29-targets-diplomatic-entities
APT29 Targets Diplomats with WINELOADER and GraphicalProton Backdoors
https://www.mandiant.com/resources/blog/apt29-wineloader-graphicalproton
NCSC Advisory: SVR cyber actors adapt tactics for initial cloud access
https://www.ncsc.gov.uk/news/svr-actors-adapt-tactics-initial-cloud-access
Mandiant: Cutting Edge Part 4 - Midnight Blizzard
https://www.mandiant.com/resources/blog/cutting-edge-part-4-midnight-blizzard
APT29 targets European diplomatic entities with WINELOADER - Zscaler ThreatLabz
https://www.zscaler.com/blogs/security-research/apt29-targets-european-diplomatic-entities-wineloader
Microsoft Digital Defense Report 2024
https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2024
NCSC Advisory: APT29 targets the UK and beyond
https://www.ncsc.gov.uk/news/latest-advisory-apt29-targets-the-uk-and-beyond
APT29 targets diplomatic entities with WINELOADER and ROOTSAW
https://www.mandiant.com/resources/blog/apt29-wineloader-rootsaw-diplomatic-targets
NCSC Advisory: APT29 targets political and diplomatic entities
https://www.ncsc.gov.uk/news/russia-associated-threat-actor-targeting-political-diplomatic-entities
CERT-EU: APT29 (Midnight Blizzard) Abuses AWS and Azure for Initial Access
https://cert.europa.eu/publications/threat-intelligence/2024/ti-alert-apt29-midnight-blizzard-abuses-aws-and-azure-for-initial-access/
CERT-EU: APT29 Diplomatic Car for Sale phishing campaign
https://cert.europa.eu/publications/security-advisories/2024-044/
WINELOADER: New APT29 backdoor targeting German political entities
https://www.mandiant.com/resources/blog/apt29-wineloader-german-politics
APT29 targets European diplomatic entities with ROOTSAW and BEATDROP
https://blog.talosintelligence.com/apt29-rootsaw-beatdrop/
APT29 targets European diplomatic entities with WINELOADER and ROOTSAW - Mandiant
https://www.mandiant.com/resources/blog/apt29-wineloader-rootsaw-diplomat
ESET Research - APT29's evolving TTPs from on-prem to cloud
https://www.welivesecurity.com/en/eset-research/apt29-evolving-ttps-prem-cloud/
NCSC Advisory: APT29 targets diplomats with ROOTSAW and BEATDROP
https://www.ncsc.gov.uk/news/russia-associated-threat-actor-targets-uk-organisations
NCSC Advisory: APT29 targeting of cloud services
https://www.ncsc.gov.uk/news/advisory-apt29-targeting-of-cloud-services
Mandiant: Cutting Edge Part 4 Sold Amendment and Closer Look at Midnight Blizzard
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-4-sold-amendment
Recorded Future: BlueCharlie Leverages Legitimate Cloud Services in APT Campaign
https://www.recordedfuture.com/bluecharlie-leverages-legitimate-cloud-services
Unit 42: ROOTSAW and BIRDDOG used in cloud espionage operations
https://unit42.paloaltonetworks.com/apt29-cloud-infrastructure/
APT29 targets European diplomatic entities with WINELOADER
https://www.welivesecurity.com/en/eset-research/apt29-targets-european-diplomatic-entities-wineloader/
APT29 Targets Global Diplomats with ROOTSAW and WINELOADER via Wine-Poisoning Attack
https://www.mandiant.com/resources/blog/apt29-wine-poisoning-diplomats
CERT-UA: UAC-0029 Implements WINELOADER Using Alcohol-Themed Lures
https://cert.gov.ua/article/6281688
Mandiant: Suspected Russian Espionage Campaign Targets Global Diplomatic Entities
https://cloud.google.com/blog/topics/threat-intelligence/russian-espionage-campaigns-diplomatic-entities
Midnight Blizzard continues to target IT service providers
https://www.microsoft.com/en-us/security/blog/2024/07/29/midnight-blizzard-targets-it-service-providers/
APT29 Targets Political Parties with Diplomatic-Themed Lures
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-political-parties
APT29 targets US-Israeli diplomatic personnel in WhatsApp phishing campaign
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-us-israeli-personnel
NCSC Advisory: APT29 targets political and diplomatic entities
https://www.ncsc.gov.uk/news/advisory-apt29-targets-political-diplomatic-entities
BfV Cyber-Brief: APT29 targets German political parties
https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/APT29/apt29_node.html
Mandiant: Suspected APT29 Phishing Campaign Targets Global Diplomatic Entities
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-global-diplomacy
NCSC-NL: APT29 targets Dutch ministries
https://www.ncsc.nl/actueel/nieuws/2024/februari/27/apt29-targets-dutch-ministries
Mandiant: Suspected APT29 Phishing Campaign Targets Global Diplomatic Missions
https://cloud.google.com/blog/topics/threat-intelligence/apt29-targets-global-diplomatic-missions
WINELOADER: Investigating a New Backdoor Deployed by APT29
https://www.zscaler.com/blogs/security-research/wineloader-investigating-new-backdoor-deployed-apt29
APT29 exploits Windows feature for stealthy backdoor communication
https://www.welivesecurity.com/en/eset-research/apt29-exploits-windows-feature-stealthy-backdoor-communication/
Poland's CERT Warning on APT29 WhisperGate-style Attacks
https://cert.pl/posts/2024/01/apt29/
Recorded Future: BlueCharlie Targeting Governments and Non-Profits in Europe and North America
https://www.recordedfuture.com/bluecharlie-targeting-governments-non-profits
APT29 Wineloader Malware: Deep Analysis and Detection
https://www.mandiant.com/resources/blog/apt29-wineloader-diplomatic-lure
NCSC Advisory: APT29 targets diplomatic sectors
https://www.ncsc.gov.uk/news/apt29-targets-diplomatic-sectors
NCSC Advisory: APT29 targets the European diplomatic sector
https://www.ncsc.gov.uk/news/apt29-targets-the-european-diplomatic-sector
Recorded Future: APT29 Targeting AWS and Azure Environments
https://www.recordedfuture.com/apt29-targets-cloud-environments
Mandiant: Cutting Edge Part 4: Ivanti Connect Secure VPN Zero-Day Exploitation
https://www.mandiant.com/resources/blog/suspected-apt29-ivanti-connect-secure-zero-day
CERT-EU Analysis of APT29 WINELOADER Malware
https://cert.europa.eu/publications/threat-intelligence/2024-084/
Mandiant APT29 Continues to Evade Detection
https://www.mandiant.com/resources/blog/apt29-continues-to-evade-detection
From Midnight to Moonlight: APT29's Continued Evolution
https://cloud.google.com/blog/topics/threat-intelligence/apt29-continued-evolution
German agencies warn of APT29 wineloader malware
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-213794-1032.pdf
NCSC and partners issue advisory on APT29's Cloud and On-Premises Tradecraft
https://www.ncsc.gov.uk/news/uk-and-allies-expose-russian-intelligence-services-cyber-activity
CERT-UA: APT29 WINELOADER Campaign Against European Entities
https://cert.gov.ua/article/6281063
Poland's CERT warns of APT29 targeting government entities
https://www.gov.pl/web/cyfryzacja/cert-ostrzega-przed-atakami-apt29
CERT-UA: UAC-0029 Continues Attacks on Diplomatic Institutions
https://cert.gov.ua/article/6281406
CERT-EU Analysis of APT29 WINELOADER Campaign
https://cert.europa.eu/publications/security-advisories/2024-032/
Mandiant: Ivanti Connect Secure VPN Exploitation by APT29
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-exploitation
Unit 42 - WINELOADER: New Malware Delivered via Diplomatic-Themed Lures
https://unit42.paloaltonetworks.com/wineloader-malware-analysis/
NCSC Advisory: APT29 targets political and diplomatic entities
https://www.ncsc.gov.uk/news/russia-behind-apt29-campaign-targeting-political-entities
APT29 targets COVID-19 vaccine development
https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development
SUNBURST Additional Technical Details
https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
Microsoft Nobelium Resource Center
https://www.microsoft.com/en-us/security/business/threat-intelligence/nobelium
UK NCSC: SVR Cyber Actors Adapt Tactics for Initial Cloud Access
https://www.ncsc.gov.uk/news/uk-partners-issue-advisory-russian-malicious-cyber-activity
ROOTSAW: New APT29 Backdoor Discovered
https://www.mandiant.com/resources/blog/rootsaw-apt29-backdoor
NCSC, international partners issue advisory on SVR cyber tactics
https://www.ncsc.gov.uk/news/ncsc-international-partners-issue-advisory-on-svr-cyber-tactics
NCSC Advisory: APT29 targets diplomatic entities
https://www.ncsc.gov.uk/news/ncsc-partners-issue-advisory-apt29