APT29G0016 state

About this actor

[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021) In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)

Source: MITRE ATT&CK

Activity timeline

• 2026 — 1 CVE published
• 2022 — 1 KEV added
• 2021 — 1 CVE published
• 2010 — 1 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• SolarWinds Compromise 2 shared CVEs
• Mustang Panda 1 shared CVEs
• APT38 1 shared CVEs
• Tonto Team 1 shared CVEs
• Ember Bear 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs
• Aquatic Panda 1 shared CVEs
• APT28 1 shared CVEs
• Sandworm Team 1 shared CVEs
• Ajax Security Team 1 shared CVEs

Similar actors