APT29, also known as Cozy Bear or Midnight Blizzard, is a highly patient and disciplined cyber espionage group attributed with high confidence to the Russian Foreign Intelligence Service (SVR). First emerging around 2008, the group was publicly identified circa 2014 and has continuously evolved its tradecraft, shifting from traditional malware-centric operations to sophisticated cloud-native techniques that heavily exploit identity systems and OAuth applications. Their primary motivation is strategic intelligence collection, focusing on political, military, economic, and diplomatic intelligence from foreign governments and related institutions, as well as intellectual property, notably seen during COVID-19 vaccine research theft. What distinguishes APT29 is its exceptional ability to maintain long-term, covert access within compromised networks, often remaining undetected for a year or more by leveraging legitimate cloud services and 'living off the land' techniques. The group operates

Aliases del actor

APT29ATK7Blue KitsuneBlueBravoCOZY BEARCloaked UrsaG0016Grizzly SteppeGroup 100IRON HEMLOCKITG11Midnight BlizzardMinidionisNobeliumSeaDukeTA421The DukesUAC-0029YTTRIUMCloudDukeCosmicDukeCozy BearCozyDukeGeminiDukeHammerDukeMiniDukeOnionDukePinchDukeCriminalCyfirmaquien ha afirmado un vínculo con APT29

Actores similares

APT29 (Cozy Bear)actor · 1apt-noisybearactor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0apt-blueprintactor · 1apt-cadetblizzardactor · 1apt-cosmicdukeactor · 1apt-desertfalconactor · 1