Security Resilience

Threat actor · all actors

APT29G0016 state

🇷🇺 RU · SVR

aka APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard, Group 100, Minidionis, SeaDuke, Grizzly Steppe, G0016, ATK7, Cloaked Ursa, TA421, ITG11, BlueBravo, UAC-0029, ICECAP, ICE RELIC, DarkHalo, StellarParticle, Solar Phoenix

Last updated: 2026-10-16

40attributed CVEs
96ATT&CK techniques
98.5IDF score (tooling uniqueness)
1exclusive CVEs
2010–2026years active

About this actor

[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021) In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0016

Microsoftweather-system names

Midnight Blizzard

CrowdStrikenation-animal names

Cozy Bear

Mandiant / genericAPT numbering

APT29

MandiantUNC uncategorised cluster

UNC2452UNC3524

Secureworkscolour-metal names

IRON RITUALIRON HEMLOCK

CERT-UAUAC cluster id

UAC-0029

ProofpointTA threat-actor id

TA421

Unclassifiedno scheme matched

NobleBaronDark HaloNOBELIUMYTTRIUMThe DukesCozyDukeSolarStormBlue KitsuneGroup 100MinidionisSeaDukeGrizzly SteppeATK7Cloaked UrsaITG11BlueBravoICECAPICE RELICDarkHaloStellarParticleSolar Phoenix

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 96 ATT&CK techniques on file.
Named victims
2 extracted from reporting.

See how actor data is built for the full pipeline.

Activity timeline

2010: 1 CVE published120102017: 1 CVE published120172018: 1 CVE published120182019: 12 CVE published1220192020: 9 CVE published920202021: 14 CVE published2021: 31 KEV added4520212022: 6 KEV added620222023: 1 CVE published2023: 1 KEV added220232026: 1 CVE published12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2021-22893 KEV10.010.00.97002021-04-23see CVE
CVE-2018-7600 KEV9.99.81.00002018-03-29see CVE
CVE-2019-0604 KEV9.99.80.99912019-03-05see CVE
CVE-2019-10149 KEV9.99.80.99962019-06-05see CVE
CVE-2019-11580 KEV9.99.80.97502019-06-03see CVE
CVE-2019-18935 KEV9.99.80.99742019-12-11see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-2725 KEV9.99.80.99982019-04-26see CVE
CVE-2019-3396 KEV9.99.80.99912019-03-25see CVE
CVE-2019-9670 KEV9.99.80.99992019-05-29see CVE
CVE-2020-12812 KEV9.99.80.49342020-07-24see CVE
CVE-2020-14882 KEV9.99.81.00002020-10-21see CVE
CVE-2020-15505 KEV9.99.80.99742020-07-07see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2021-21985 KEV9.99.81.00002021-05-26see CVE
CVE-2021-27101 KEV9.99.80.06002021-02-16see CVE
CVE-2021-27103 KEV9.99.80.11412021-02-16see CVE
CVE-2021-27104 KEV9.99.80.56692021-02-16see CVE
CVE-2023-42793 KEV9.99.80.99992023-09-19see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2021-22894 KEV9.28.80.50622021-05-27see CVE
CVE-2021-22899 KEV9.28.80.38002021-05-27see CVE
CVE-2020-4006 KEV9.09.10.55212020-11-23see CVE
CVE-2010-0232 KEV8.57.80.76562010-01-21see CVE
CVE-2017-11882 KEV8.57.80.99942017-11-15see CVE
CVE-2019-1653 KEV8.57.50.99882019-01-24see CVE
CVE-2020-0787 KEV8.57.80.91412020-03-12see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2021-27102 KEV8.57.80.03652021-02-16see CVE
CVE-2021-22900 KEV8.17.20.14152021-05-27see CVE
CVE-2019-5591 KEV7.76.50.56822020-08-14see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2020-8554 6.56.30.31202021-01-21see CVE
CVE-2026-20929 6.27.50.02912026-01-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-463 / 9666%
CM-661 / 9664%
AC-354 / 9656%
AC-651 / 9653%
AC-249 / 9651%
CM-247 / 9649%
IA-241 / 9643%
CA-738 / 9640%
CM-738 / 9640%
AC-536 / 9638%
SI-335 / 9636%
SI-733 / 9634%
CM-532 / 9633%
AC-426 / 9627%
SC-724 / 9625%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category