Watch Floor
State-backedRussiaMITRE G0016

APT29

Also known as Group 100, COZY BEAR, The Dukes, Minidionis, SeaDuke, YTTRIUM, IRON HEMLOCK, Grizzly Steppe, G0016, ATK7, Cloaked Ursa, TA421, Blue Kitsune, ITG11, BlueBravo, Nobelium, UAC-0029, ICECAP, ICE RELIC, IRON RITUAL

18mentions, 7 days
18mentions, 30 days
Nov 6, 2026last mentioned

A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the comp

Targets: Government, Private sector, United States, China, New Zealand, Ukraine, Romania, Georgia, Japan, South Korea, Belgium, Kazakhstan, Brazil, Mexico, Turkey

CVEs in recent coverage

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.002 Security Account ManagerT1003.004 LSA SecretsT1005 Data from Local SystemT1016.001 Internet Connection DiscoveryT1021.007 Cloud ServicesT1027.001 Binary PaddingT1027.002 Software PackingT1027.006 HTML SmugglingT1036.005 Match Legitimate Resource Name or LocationT1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.006 PythonT1059.009 Cloud APIT1068 Exploitation for Privilege EscalationT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1087.004 Cloud AccountT1090.002 External ProxyT1090.003 Multi-hop ProxyT1090.004 Domain FrontingT1098.002 Additional Email Delegate PermissionsT1098.005 Device RegistrationT1105 Ingress Tool TransferT1110.001 Password GuessingT1110.003 Password SprayingT1114.002 Remote Email CollectionT1133 External Remote ServicesT1136.003 Cloud AccountT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1218.005 MshtaT1505.003 Web ShellT1528 Steal Application Access TokenT1546.003 Windows Management Instrumentation Event SubscriptionT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account ControlT1550.003 Pass the TicketT1553.005 Mark-of-the-Web BypassT1556.007 Hybrid IdentityT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via ServiceT1568 Dynamic ResolutionT1573 Encrypted ChannelT1583.006 Web ServicesT1586.002 Email AccountsT1586.003 Cloud AccountsT1587.001 MalwareT1587.003 Digital CertificatesT1588.002 ToolT1595.002 Vulnerability ScanningT1621 Multi-Factor Authentication Request GenerationT1649 Steal or Forge Authentication CertificatesT1651 Cloud Administration CommandT1665 Hide InfrastructureT1685.002 Disable or Modify Cloud Log

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.