APT29

Also tracked as Cozy Bear, Midnight Blizzard, Nobelium, The Dukes, UNC2452

APT29 is a Russian state sponsored espionage group linked to the SVR and responsible for the SolarWinds intrusions. It specializes in cloud and identity attacks against Microsoft 365 and Azure. It forges tokens and abuses OAuth applications and service principals to read targeted email.

Cloud tradecraft

• Forges SAML tokens with stolen signing certificates to access cloud services
• Adds credentials and roles to OAuth apps and service principals
• Changes domain federation trust to accept attacker signed tokens
• Enrolls attacker devices and grants mailbox permissions for email collection
• Steals and replays application access tokens to bypass passwords

MITRE ATT&CK techniques

References

• MITRE ATT&CK: APT29 (G0016)
• You Can't Audit Me: APT29 Continues Targeting Microsoft 365
• SVR Cyber Actors Adapt Tactics for Initial Cloud Access (AA24-057A)
• Midnight Blizzard: Guidance for responders on nation-state attack
• Customer Guidance on Recent Nation-State Cyber Attacks