Threat Advisory: The Historical and Ongoing Threat of APT29

What UltraViolet Cyber is Doing

• Tracking new CVEs and high impact vulnerabilities, analyzing and deploying public Proof-Of-Concept code against custom built targets.
• Proactively enabling custom detections based on the collected artifacts, tactics, techniques, and procedures identified in this activity.
• Performing hypothesis driven threat hunts based on threat actor behavior and artifacts. UVCyber customers will be informed of the results through secure channels.
• Parsing available victim dump data for any social, financial, business, or technical relations to UVCyber Clients and partner organizations.
• Aggregating threat intelligence from myriad sources and applying the most up-to-date knowledge to proactive threat hunting and response.
  
  
  

ADVERSARY PROFILE

APT29

Cozy Bear / Midnight Blizzard / NOBELIUM

Notable TTPs

1. Spearphishing with malicious links or attachments to gain initial access
2. Abuse of legitimate cloud authentication flows, including device code and OAuth token theft
3. Password spraying and credential stuffing against cloud identity providers
4. Compromise of trusted third parties, including software supply chains and managed service providers
5. Use of custom backdoors and loaders for long term persistence
6. Living off the land using native cloud administration tools to avoid detection
7. Manipulation of mail forwarding rules and application permissions to maintain covert access
8. Iterative retooling of malware using AI to evade detection once identified by security products (seen with GTG-20006)

APT29 is one of the most closely watched state-linked actors in the world with attribution grounded in over a decade of independently corroborated reporting from multiple national cybersecurity authorities. The recent Anthropic-documented cluster (GTG-20006) is described as consistent with this actor based on operator characteristics and targeting patterns, though full attribution confidence on every individual incident within that cluster hasn't been independently confirmed by outside researchers. A related sub-cluster, tracked by Microsoft as Storm-2945, is assessed as an operational offshoot of the same broader group.

Attribution. The group's recent campaign concentrated heavily on Ukrainian and European government, military, and diplomatic targets, which is consistent with APT29's long-standing intelligence-collection mission tied to Russian state interests. Beyond the core government and defense set, the campaign also reached into adjacent categories that support or surround those primary targets: hospitality companies (through hotel guest Wi-Fi providers), drone manufacturers and their supply chains, and camera/surveillance platforms.

Operational techniques. The recent campaign combined several access and persistence methods that, individually, aren't new to this group's playbook, but were notable for how quickly and broadly they were applied:

Network infiltration via travel infrastructure: The group compromised at least three companies providing hotel guest Wi-Fi services, manipulating DNS records to intercept and redirect traffic from traveling diplomatic and defense personnel (a technique aimed at intercepting officials while away from hardened home networks).

Identity and credential abuse: Device-code and OAuth-based phishing against cloud email accounts, along with takeovers of messaging accounts, gave the group footholds into individual users' communications. Separately, stolen credentials for VPN appliances have let the group seize control of central identity systems.

Surveillance platform exploitation: The group identified authorization weaknesses in camera-streaming platform interfaces, letting it enumerate user accounts and obtain tokens granting access to live video feeds.

Present vs. historical baseline. The substance of these techniques (such as credential phishing, supply-chain-adjacent targeting, persistent tooling refreshes) fits APT29's known long-term behavior. What the recent reporting highlights is pace and breadth: a larger number of concurrent targets and a faster iteration cycle on evasion than has typically been documented for this actor, attributed in part to the group's use of AI-assisted workflows for tasks like infrastructure setup and code maintenance.

APT29 is not a speculative or emerging risk. Instead, it's a mature, well-resourced actor with a track record that includes some of the most consequential espionage incidents of the past decade, from large-scale government network intrusions to supply-chain compromises that rippled across thousands of downstream organizations. Its continued activity against government, defense, and diplomatic organizations means any entity in those sectors, or serving as a vendor or partner to them, should treat this group as a standing part of their threat model rather than a hypothetical or distant concern. The group's persistence over more than a decade, and its consistent backing by a well-resourced state sponsor, mean it isn't going away, isn't running out of funding, and isn't likely to shift toward less sophisticated tradecraft over time.

The recent campaign broadens the target aperture in a way that matters to a wider set of organizations than those typically thought of as espionage targets. Hospitality companies, camera and surveillance-platform vendors, and drone-technology suppliers may not consider themselves likely targets of state-sponsored intelligence collection, but this activity shows they can become entry points or objectives in their own right. Any organization providing infrastructure, software, or services to sensitive-sector clients (such as government, defense, diplomatic, or critical-infrastructure) should assume it could be targeted as a path into those clients, not only as a target itself. This kind of indirect targeting is often harder to anticipate, because it requires organizations to think beyond their own risk profile and consider the risk profile of everyone they serve.

A recent identity-database compromise of a North African government entity is a useful illustration of concentrated risk in modern identity architecture. A single compromised VPN credential cascaded into full control of a central identity system and the exposure of hundreds of thousands of national identity records and business registrations. This is a pattern worth internalizing broadly: as organizations centralize identity and access management for the sake of efficiency and control, they also concentrate consequence. A compromise that might once have been contained to a single application or department can now expose an entire organization's identity infrastructure. Segmentation, monitoring, and least-privilege design around these central systems aren't optional hardening steps; they're what determines whether an incident stays small or becomes catastrophic.

The group's demonstrated interest in traveling personnel, via hotel network compromise, is a reminder that organizational security perimeters extend wherever staff travel. It is noteworthy that this extension is often the weakest and least-monitored part of an organization's overall footprint. Diplomatic, defense, and executive staff traveling internationally represent a persistent soft spot that home-network protections, corporate firewalls, and standard endpoint monitoring typically don't cover. Savvy attackers are aware of this and this campaign shows a willingness to invest in compromising third-party infrastructure (hotel Wi-Fi providers) specifically to exploit that gap, rather than relying solely on more conventional phishing or credential-theft methods.

Finally, the accelerated iteration on detection evasion signals that defenders should expect this actor's malware and infrastructure to change faster than in years past, regardless of the specific tooling or methods behind that acceleration. Detection strategies built primarily around static indicators of compromise, hash-based signatures, or known infrastructure will have a shorter effective shelf life against this adversary going forward. Organizations that haven't already begun shifting investment toward behavior-based detection, anomaly detection, and identity-centric monitoring should treat this as a clear signal to accelerate that transition, since the gap between attacker adaptation speed and defender detection-update speed appears to be widening rather than narrowing.

• Tracking new CVEs and high impact vulnerabilities, analyzing and deploying public Proof-Of-Concept code against custom built targets.
• Proactively enabling custom detections based on the collected artifacts, tactics, techniques, and procedures identified in this activity.
• Performing hypothesis driven threat hunts based on threat actor behavior and artifacts. UVCyber customers will be informed of the results through secure channels.
• Parsing available victim dump data for any social, financial, business, or technical relations to UVCyber Clients and partner organizations.
• Aggregating threat intelligence from myriad sources and applying the most up-to-date knowledge to proactive threat hunting and response.