ThreatRoundup

APT29 (Midnight Blizzard)

Russian SVR espionage group behind the SolarWinds hack and Microsoft's 2024 email breach, phishing diplomats and abusing cloud identity, now hijacking hotel Wi-Fi.

Threat actor profile · Updated

Active
2008 to October 2026
Origin
Russia (Foreign Intelligence Service, SVR, per US and UK governments)
Type
State-sponsored
Affiliates
Russian Foreign Intelligence Service (SVR); UNC2452 and UNC3524 (merged into APT29 by Mandiant); Storm-2945 and Storm-2372 (Midnight Blizzard sub-clusters per Microsoft); UNC6293 (low-confidence link per Google); CozyLarch (overlap per Volexity)
Regions targeted
United States, NATO and EU member states, Ukraine, United Kingdom, Germany, Poland, Australia, Japan, Mongolia, Africa, Asia, global
MITRE ATT&CK
G0016

What each vendor calls it

Microsoft
Midnight BlizzardNOBELIUMYTTRIUM
CrowdStrike
Cozy BearCozyDuke
Google / Mandiant
APT29UNC2452UNC3524
Palo Alto Unit 42
Cloaked UrsaSolarStorm
Sophos / Secureworks
IRON HEMLOCKIRON RITUAL
Proofpoint
TA421
ESET
The Dukes
Recorded Future
BlueBravo
IBM X-Force
ITG11

Also known as ATK7Blue Kitsune PwCDark Halo VolexityGroup 100ICE RELICICECAPMinidionisNobleBaron SentinelOneSeaDukeSolar PhoenixStellarParticleUAC-0029 CERT-UA

See this actor in the Threat Actor Rosetta Stone →

Profile

APT29 is the hacking arm most closely tied to Russia’s Foreign Intelligence Service, the SVR. MITRE ATT&CK tracks it as a group operating since at least 2008, and the attribution is not just a vendor call: on April 15, 2021 the US government formally named the SVR as the actor behind the SolarWinds compromise, which it said is also known as APT29, Cozy Bear and The Dukes, and the UK made the same call the same day. Later joint advisories from the FBI, NSA, CISA, the UK NCSC and Polish agencies all write about “SVR cyber actors” rather than a vendor nickname, and Microsoft, which calls the group Midnight Blizzard (formerly NOBELIUM), repeats the US and UK attribution in every report.

The mission is classic foreign intelligence. The October 2024 FBI, NSA, Cyber National Mission Force and NCSC advisory splits SVR victims into “targets of intent” (governments, diplomats, think tanks, international organizations, technology firms and cleared defense contractors in North America and Western Europe, with Ukraine a steady focus since 2021) and “targets of opportunity”: anyone with an unpatched internet-facing server the SVR can borrow for infrastructure or use as a stepping stone. That second category is why companies with no obvious link to Russian policy keep turning up in APT29 incident reports.

The group’s defining operation was the SolarWinds Orion supply-chain attack. FireEye (now Mandiant) disclosed in December 2020 that trojanized Orion updates had delivered the SUNBURST backdoor to Orion customers, with hands-on follow-up at a much smaller set of government and technology targets. Mandiant tracked the campaign as UNC2452 until April 2022, when it merged it into APT29. Its review is a good summary of the group’s style: from 2018 to 2021 it used custom malware in a little under half of its intrusions, preferring stolen credentials, Golden SAML token forgery and native Microsoft 365 features, and it sometimes reached domain admin within 12 hours of a phishing payload running. Mandiant later folded UNC3524, a cluster that hid on unmonitored network appliances for at least 18 months while reading executives’ mail, into APT29 as well.

Identity is the main battleground. In 2023 and 2024 the SVR’s preferred way in became password spraying from residential proxies, abuse of OAuth applications and dormant or service accounts, MFA fatigue and registering its own devices in victims’ cloud tenants, all described in the February 2024 CISA and NCSC advisory AA24-057A. The most striking example was Microsoft itself: the company detected Midnight Blizzard in its corporate email in January 2024 after the actor password-sprayed a legacy test tenant account without MFA and then abused a test OAuth app to read executives’ and security staff’s mailboxes. CISA’s Emergency Directive 24-02 later said the actor had stolen email between federal agencies and Microsoft and tried to use credentials found in it. Since 2025 the group has leaned hard on device code phishing, which tricks a user into authorizing an attacker’s session on the real Microsoft sign-in page, and Google has seen a likely related cluster talk targets into handing over Gmail app-specific passwords.

Phishing against diplomats has never stopped, and the lures keep getting more personal. Polish military counterintelligence and CERT Polska documented 2022 and 2023 waves against NATO and EU foreign ministries using HTML smuggling (EnvyScout) and loaders that talked to Notion. In 2024 Mandiant saw fake dinner invitations in German carrying a new backdoor, WINELOADER, aimed at German political parties, the first time it had seen this subcluster go after parties rather than embassies. Check Point reported the same wine-tasting theme against European diplomats in early 2025, and Microsoft logged a spear-phishing wave in October 2024 that mailed signed RDP configuration files to thousands of people at more than 100 organizations.

APT29 also exploits software, mostly n-days and at scale. Joint advisories list it abusing Fortinet, Pulse Secure, Citrix, Zimbra and VMware flaws in 2021, Zimbra mail servers across hundreds of domains, and from September 2023 the JetBrains TeamCity bug CVE-2023-42793, which the FBI, CISA, NSA, SKW, CERT Polska and NCSC warned could set up another software supply-chain attack. One finding stands out: Google’s Threat Analysis Group, with moderate confidence, tied a 2023 to 2024 watering-hole campaign on Mongolian government sites to APT29 and found it reusing iOS and Chrome exploits identical or very similar to ones sold by Intellexa and NSO Group.

The newest shift is toward travelers and AI-assisted tooling. In July 2026 Microsoft described CaptiveCrunch, run by a Midnight Blizzard sub-cluster it calls Storm-2945: since May 2026 the operators manipulated hotel and venue Wi-Fi captive portals to push fake browser updates and ClickFix prompts that installed a Go RAT called CornFlake, or steered travelers into device code phishing. Microsoft says the sub-cluster uses AI for a significant part of its operations, that the campaign resumed on September 29, 2026, apparently through continued access to hospitality managed service providers, and that it now regards Storm-2372, the device code phishing actor it first described in February 2025 only as Russia-aligned, as Midnight Blizzard’s initial-access sub-cluster.

Naming is crowded: Mandiant uses APT29 (with the retired UNC2452 and UNC3524), Microsoft Midnight Blizzard, CrowdStrike Cozy Bear, ESET The Dukes, Unit 42 Cloaked Ursa, Recorded Future BlueBravo, Volexity Dark Halo and CozyLarch, Google’s newer reports ICECAP, and CERT-UA UAC-0029 (full list above). Vendors don’t always agree on where APT29 ends and a related SVR cluster begins, so this profile says which vendor made each call.

Events

Date Target Narrative Source Our coverage
2026-05 to 2026-10 Corporate travelers using hotel, conference-center and airport Wi-Fi worldwide CaptiveCrunch: Microsoft’s Storm-2945, a Midnight Blizzard sub-cluster, uses an T1557 (Adversary-in-the-Middle) position on captive-portal networks to serve fake browser and OS updates and ClickFix prompts, T1204.004 (User Execution: Malicious Copy and Paste), installing the CornFlake RAT and ChocoShell stealer or pushing device code phishing. The campaign resumed on Sept. 29, 2026, with a Rust CornFlake variant in some cases. Microsoft
2026-08 to 2026-09 Phone users visiting compromised sites in Ukraine, the US, the Czech Republic and Bulgaria, and thousands of mostly Ukrainian sites (including army, special forces and drone-equipment sites) that loaded the Plerdy SEO tracker Sekoia reports watering holes, lookalike reverse-proxy sites and, from Aug. 27 to Sept. 3, 2026, a poisoned Plerdy main.js (T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), T1189 (Drive-by Compromise)) that fingerprinted visitors and served n-day exploit chains for iOS (including DarkSword) and Android Chrome (T1203 (Exploitation for Client Execution)) to steal cookies, messages, Keychain data and Wi-Fi passwords. Sekoia attributes it to APT29 or a subgroup with moderate to high confidence. Sekoia Our story
2026-02 Microsoft 365 users Microsoft says Storm-2945 began AI-assisted device code and OAuth code phishing against Microsoft 365 accounts, the precursor to CaptiveCrunch. Microsoft
2025-08 Visitors to compromised legitimate websites Amazon disrupts an APT29 watering-hole operation, T1189 (Drive-by Compromise): injected JavaScript sent about 10% of visitors to fake Cloudflare verification pages that walked them through Microsoft device code authentication for an attacker device. The actor moved to new domains after takedown. Amazon
2025-04 to 2025-06 Prominent academics, critics of Russia and journalists Google’s UNC6293, which it links to APT29 only with low confidence, poses as the US State Department and talks targets into creating Gmail app-specific passwords and sending them over, giving persistent mailbox access without the password or 2-step verification. Google GTIG
2025-01 onward European foreign ministries and embassies Check Point reports fake wine-tasting and diplomatic-dinner invitations impersonating a European foreign ministry, delivering the new GRAPELOADER loader and a fresh WINELOADER variant. Check Point
2025-02 Recipients of fake US State Department invitations Volexity’s CozyLarch, which it says overlaps with APT29, sends fake Microsoft 365 tenant and Teams chat invitations whose links lead to the real device login page, T1528 (Steal Application Access Token). Microsoft separately reports Storm-2372 device code phishing since August 2024; in 2026 it calls Storm-2372 a Midnight Blizzard sub-cluster. Volexity, Microsoft
2024-10 Government, higher education, defense and NGOs in the UK, Europe, Australia and Japan Spear-phishing with signed RDP configuration files, T1566.001 (Phishing: Spearphishing Attachment), sent to thousands of people at more than 100 organizations; opening one connects the victim’s drives, clipboard and smart cards to an attacker server. CERT-UA tracked overlapping activity as UAC-0215. Microsoft
2023-11 to 2024-07 Visitors to Mongolian government websites (cabinet.gov.mn, mfa.gov.mn) Watering-hole attacks serve an iOS Safari exploit (CVE-2023-41993) and later a Chrome on Android chain (CVE-2024-5274, CVE-2024-4671) to steal browser cookies. Google TAG ties them to APT29 with moderate confidence and notes the exploits match ones sold by Intellexa and NSO Group. Google TAG
2024-06 TeamViewer corporate IT environment Attackers use a standard employee’s credentials to copy employee directory data, including encrypted passwords. TeamViewer attributes the intrusion to APT29 / Midnight Blizzard and says its product environment and customer data were not affected. TeamViewer
2024-01 to 2024-03 German political parties; diplomatic entities in Czechia, Germany, India, Italy, Latvia and Peru German-language CDU dinner invitations link to ROOTSAW (EnvyScout), which side-loads the new WINELOADER backdoor, T1574.001 (Hijack Execution Flow: DLL). Mandiant calls it the first time this APT29 subcluster has targeted political parties. Mandiant
2023-11 to 2024-04 Microsoft corporate email; US federal agencies T1110.003 (Brute Force: Password Spraying) against a legacy test tenant account without MFA, then a hijacked test OAuth app grants new apps full mailbox access, T1098.001 (Account Manipulation: Additional Cloud Credentials). Microsoft detected it on Jan. 12, 2024; CISA’s ED 24-02 says email between agencies and Microsoft was stolen. Microsoft, CISA ED 24-02
2023-09 to 2023-12 A few dozen companies in the US, Europe, Asia and Australia, including software developers, hosting firms and an energy trade association Mass exploitation of JetBrains TeamCity (CVE-2023-42793), T1190 (Exploit Public-Facing Application), followed by the GraphicalProton backdoor talking through OneDrive and Dropbox, T1102.002 (Web Service: Bidirectional Communication). The agencies assess it may have been groundwork for supply-chain attacks. CISA AA23-347A
2023-05 to 2023-08 Fewer than 40 organizations in government, NGOs, IT, technology, manufacturing and media From hijacked small-business Microsoft 365 tenants renamed to look like support teams, operators send Teams chats, T1566.003 (Phishing: Spearphishing via Service), asking targets to approve an Authenticator prompt, then sometimes register a device, T1098.005 (Account Manipulation: Device Registration). Microsoft
2022-10 to 2023-04 Foreign ministries and diplomats, mainly in NATO and EU states, fewer in Africa Phishing with HTML smuggling, T1027.006 (Obfuscated Files or Information: HTML Smuggling), ISO and IMG images and DLL side-loading delivers SNOWYAMBER (which uses Notion for command and control), HALFRIG and QUARTERRIG, then Cobalt Strike or Brute Ratel. SKW and CERT Polska
2022 (reported May) Mailboxes of executives and M&A, corporate development and IT security staff Mandiant’s UNC3524 hides on SAN arrays, load balancers and wireless controllers with the QUIETEXIT backdoor, uses hijacked conference-room cameras for command and control and stays undetected for at least 18 months, reading mail through Exchange Web Services, T1114.002 (Email Collection: Remote Email Collection). Mandiant merged UNC3524 into APT29 in November 2022. Mandiant
2021-05 Government agencies, think tanks, consultants and NGOs After taking over a USAID account on the Constant Contact mailing service, the group sends phishing to about 3,000 accounts at more than 150 organizations, T1566.002 (Phishing: Spearphishing Link). Volexity tracks related election-fraud-themed lures as a suspected APT29 operation. Microsoft, Volexity
2021-03 Government officials in Western European countries LinkedIn messages lead iPhone users to a WebKit zero-day (CVE-2021-1879) that steals login cookies for major web services. Google TAG calls the actor likely Russian government-backed and the same one behind an operation Volexity attributes to suspected APT29. Google TAG
2021-04 Not applicable (attribution and advisory) The US and UK formally attribute the SolarWinds compromise to the SVR. A follow-up US advisory lists five VPN, mail and identity-gateway flaws (Fortinet, Pulse Secure, Citrix, Zimbra, VMware) the SVR was exploiting for initial access. US Treasury, NCSC, CISA AA21-116A
2020-03 to 2020-12 SolarWinds Orion customers, including US federal agencies and technology firms Trojanized Orion updates deliver SUNBURST, T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain); selected victims get TEARDROP and Cobalt Strike, and the actor forges tokens with stolen AD FS signing certificates, T1606.002 (Forge Web Credentials: SAML Tokens), to reach Microsoft 365 mail. FireEye, CISA AA20-352A
2020 (advisory July) COVID-19 vaccine research and development organizations in the UK, US and Canada The UK NCSC, Canada’s CSE and the US NSA say APT29 scanned for and exploited VPN and mail-server flaws and deployed the WellMess and WellMail malware against vaccine developers, highly likely to steal research on COVID-19 vaccines. NCSC, CSE, NSA
2013 to 2019 Foreign ministries in at least three European countries and an EU country’s embassy in Washington ESET’s Operation Ghost: PolyglotDuke, RegDuke, MiniDuke and FatDuke, with command-and-control addresses hidden on Twitter, Reddit and Imgur and payloads concealed in images, showing The Dukes never went quiet after 2015. ESET
2018-11 Government, defense, media, think tanks, law enforcement and transportation organizations A phishing wave spoofing a US State Department official delivers a malicious LNK file and Cobalt Strike; FireEye calls it a suspected APT29 campaign, noting overlaps with a 2016 operation. FireEye
2015 to 2016 US Democratic National Committee and other political organizations CrowdStrike finds Cozy Bear inside the DNC network from summer 2015, separately from Fancy Bear. The December 2016 US GRIZZLY STEPPE report names APT29 as the actor that entered a US political party’s systems in 2015. CrowdStrike, DHS and FBI
2008 Governments and related organizations Earliest activity MITRE attributes to the group. MITRE ATT&CK

Target vectors risk profile

Government Diplomatic Cloud/identity Technology/SaaS Software supply chain Dissidents/NGOs Education/research Defense Media/journalists Elections Edge devices/VPNs Healthcare Transportation/logistics Energy Finance
High High High High High High Medium Medium Medium Medium Medium Medium Medium Low Low

Malware and tools

Name What it does Public detection Hunt Leads Reports
UltimateFingerprinter, DarkSword, AndroSnitch JavaScript fingerprinting script that decides which phones get exploits; iOS 18 exploit chain that pulls messages, mail, Keychain, location and photos; Android Chrome chain that steals cookies, logins and saved Wi-Fi passwords Indicators in Sekoia’s report (its YARA rules are shared with CERTs only, TLP:AMBER) 4 Hunt Leads Sekoia
CornFlake, ChocoShell, FruitStone Go (and later Rust) Windows RAT with keylogging, screen, audio and webcam capture; in-memory PowerShell stealer for cookies and Microsoft 365 tokens; operator panel disguised as a cloud console Hunting queries and indicators in Microsoft’s report Microsoft
WINELOADER, GRAPELOADER, ROOTSAW (EnvyScout) Modular backdoor side-loaded through legitimate binaries; newer loader used in 2025 wine-tasting lures; HTML-smuggling first stage YARA hunting rules in Mandiant’s report Mandiant, Check Point
GraphicalProton Backdoor that hides commands and results in BMP images on OneDrive and Dropbox, deployed after TeamCity exploitation YARA rules and indicators in CISA AA23-347A CISA AA23-347A
SNOWYAMBER, HALFRIG, QUARTERRIG Downloaders and loaders from the 2022 to 2023 diplomatic phishing waves; SNOWYAMBER uses Notion for command and control Indicators in the SKW and CERT Polska report SKW and CERT Polska
QUIETEXIT Dropbear SSH-based backdoor run on network appliances that lack EDR Hunting commands in Mandiant’s report Mandiant
SUNBURST, TEARDROP, RAINDROP Backdoor hidden in SolarWinds Orion updates and the droppers that loaded Cobalt Strike BEACON on chosen victims Mandiant countermeasures; community YARA rules in signature-base FireEye, CISA AA20-352A
GoldMax, GoldFinder, Sibot Second-stage backdoor, HTTP tracer and persistence tool found in SolarWinds follow-on intrusions Indicators in Microsoft’s report Microsoft
WellMess, WellMail Go and .NET implants used against COVID-19 vaccine research in 2020 Indicators and YARA rules in the NCSC, CSE and NSA advisory NCSC, CSE, NSA
MiniDuke, PolyglotDuke, RegDuke, FatDuke The Dukes’ long-running backdoor family, using social media and image steganography for command and control Indicators in ESET’s malware-ioc repository ESET
Cobalt Strike, Brute Ratel Commercial post-exploitation frameworks the group has favored since 2021, partly to blur attribution Community YARA rules in signature-base (older APT29 tooling); Cobalt Strike rules widely published Mandiant, SKW and CERT Polska

Reports

Date Source Report
2026-11 Sekoia Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
2026-07-31 Microsoft CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft (updated October 5, 2026)
2025-08-29 Amazon Amazon disrupts watering hole campaign by Russia’s APT29
2025-06-18 Google GTIG What’s in an ASP? Creative phishing attack on prominent academics and critics of Russia
2025-04 Check Point Renewed APT29 phishing campaign against European diplomats
2025-02-13 Volexity Multiple Russian threat actors targeting Microsoft device code authentication
2024-10-29 Microsoft Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
2024-10-10 FBI, NSA, CNMF, NCSC Update on SVR cyber operations and vulnerability exploitation
2024-08-29 Google TAG State-backed attackers and commercial surveillance vendors repeatedly use the same exploits
2024-04-02 CISA ED 24-02: Mitigating significant risk from nation-state compromise of Microsoft corporate email system
2024-03-22 Mandiant APT29 uses WINELOADER to target German political parties
2024-02-26 CISA, NCSC and partners SVR cyber actors adapt tactics for initial cloud access
2024-01-25 Microsoft Midnight Blizzard: guidance for responders on nation-state attack
2023-12-13 FBI, CISA, NSA, SKW, CERT Polska, NCSC Russian Foreign Intelligence Service (SVR) exploiting JetBrains TeamCity CVE globally
2023-08-02 Microsoft Midnight Blizzard conducts targeted social engineering over Microsoft Teams
2023-04-13 SKW, CERT Polska Espionage campaign linked to Russian intelligence services
2022-05-02 Mandiant UNC3524: Eye spy on your email
2022-04-27 Mandiant Assembling the Russian nesting doll: UNC2452 merged into APT29
2021-05-27 Microsoft New sophisticated email-based attack from NOBELIUM
2021-04-26 FBI, DHS, CISA Russian Foreign Intelligence Service (SVR) cyber operations: trends and best practices for network defenders
2021-04-15 US Treasury Treasury sanctions Russia with sweeping new sanctions authority
2021-03-04 Microsoft GoldMax, GoldFinder, and Sibot: analyzing NOBELIUM’s layered persistence
2020-12-13 FireEye Highly evasive attacker leverages SolarWinds supply chain to compromise multiple global victims with SUNBURST backdoor
2020-07-16 NCSC, CSE, NSA Advisory: APT29 targets COVID-19 vaccine development
2019-10-17 ESET Operation Ghost: the Dukes aren’t back, they never left
2016-06-15 CrowdStrike Bears in the midst: intrusion into the Democratic National Committee

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2025-43520 5.5 Medium Apple iOS and other Apple OSes Yes
CVE-2024-27834 5.5 Medium Apple iOS and other Apple OSes (PAC bypass) Yes
CVE-2025-27038 7.5 High Qualcomm Adreno GPU (Android chipsets) Yes
CVE-2025-43510 7.8 High Apple iOS and other Apple OSes Yes
CVE-2026-20700 7.8 High Apple iOS and other Apple OSes Yes
CVE-2026-3910 8.8 High Google Chromium V8 on Android Yes
CVE-2025-14174 8.8 High Google Chromium (ANGLE), used in an iOS chain Yes
CVE-2025-43529 8.8 High Apple iOS and other Apple OSes (WebKit) Yes
CVE-2024-5274 9.6 Critical Google Chrome (V8) Yes
CVE-2024-4671 9.6 Critical Google Chrome (Visuals) Yes
CVE-2023-42793 9.8 Critical JetBrains TeamCity Yes
CVE-2023-41993 8.8 High Apple Safari / WebKit on iOS Yes
CVE-2022-27924 7.5 High Synacor Zimbra Collaboration Suite Yes
CVE-2021-1879 6.1 Medium Apple WebKit on iOS Yes
CVE-2020-4006 9.1 Critical VMware Workspace ONE Access and related identity products Yes
CVE-2019-19781 9.8 Critical Citrix Application Delivery Controller and Gateway Yes
CVE-2019-11510 10.0 Critical Pulse Secure (Ivanti) Pulse Connect Secure VPN Yes
CVE-2019-9670 9.8 Critical Synacor Zimbra Collaboration Suite Yes
CVE-2018-13379 9.8 Critical Fortinet FortiOS SSL VPN Yes

If you’re in their sights

Do this now

  1. Move high-value staff to phishing-resistant MFA (passkeys or hardware keys), block the device code sign-in flow with Conditional Access unless a team truly needs it, and enroll at-risk people in Google’s Advanced Protection so app-specific passwords can’t be created. Most recent APT29 access came from users approving a real sign-in for the attacker.
  2. Hunt your tenant for what the group leaves behind: OAuth apps with mail-wide permissions such as full_access_as_app, new credentials added to service principals, unfamiliar registered devices and forgotten test or service accounts without MFA. Disable dormant accounts rather than just resetting their passwords.
  3. Patch internet-facing VPNs, mail servers and build systems (Fortinet, Pulse/Ivanti, Citrix, Zimbra, TeamCity) quickly. The SVR mass-scans for these and uses opportunistic victims as launch points.
  4. Block .rdp file attachments at the mail gateway and restrict outbound RDP to the internet, and tell staff that a dinner invitation or “verification” page asking them to run a file or paste a command is an attack.
  5. Give traveling staff a mobile hotspot or always-on VPN and a rule never to install updates, certificates or tools offered by hotel or airport Wi-Fi portals. Watch for logins from residential proxy ranges that don’t match the user’s usual devices.

Compiled from US Treasury, CISA, FBI, NSA and UK NCSC advisories, Polish SKW and CERT Polska, Microsoft, Mandiant and FireEye, Google TAG and GTIG, Amazon, Volexity, Check Point, ESET, CrowdStrike, TeamViewer and MITRE ATT&CK. Last reviewed November 5, 2026.

ATT&CK techniques (66)

Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.

Reconnaissance 1
Resource Development 6
Initial Access 9
Execution 9
Persistence 15
Privilege Escalation 13
Stealth 10
Defense Impairment 3
Credential Access 8
Discovery 2
Lateral Movement 2
Collection 2
Command and Control 7

Software MITRE links to this group (49)

AADInternals AdFind BloodHound BoomBox CloudDuke Cobalt Strike CosmicDuke CozyCar EnvyScout FatDuke FoggyWeb GeminiDuke GoldFinder GoldMax HAMMERTOSS Impacket ipconfig LiteDuke meek Mimikatz MiniDuke NativeZone Net OnionDuke PinchDuke PolyglotDuke POSHSPY PowerDuke PsExec QUIETEXIT Raindrop RegDuke reGeorg ROADTools SDelete SeaDuke Sibot Sliver SoreFang SUNBURST SUNSPOT Systeminfo Tasklist TEARDROP Tor TrailBlazer VaporRage WellMail WellMess

ThreatRoundup coverage

1 of these story has Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.