Skip to content
Nation-state APTIdeologyStrategic sophistication · State-backed

APT29

APT29 is a Russia-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 14 sectors, including Government and Technology, in 54 countries, including the United States and the United Kingdom. It uses 210 MITRE ATT&CK techniques and exploits 27 known CVEs.

Also known as
  • Cozy Bear
  • Midnight Blizzard
  • Nobelium
  • The Dukes
  • IRON RITUAL
  • IRON HEMLOCK
  • NobleBaron
  • Dark Halo
  • UNC2452
  • YTTRIUM
  • CozyDuke
  • SolarStorm
  • Blue Kitsune
  • UNC3524
  • Group 100
  • Minidionis
  • Cloudlook
  • Atk 7
  • ITG11
  • Unc5452
  • StellarParticle
  • Silver Fish
  • Cloaked Ursa
  • Blue Dev 5
  • TEMP.Monkeys
  • Solar Phoenix
  • Cranefly
  • SVR
Origin
Russia
Techniques
210
Exploited CVEs
27
First seen
Jan 1, 2008
Last seen
Aug 29, 2025
Record updated

Who They Target.

Labelsactive-2025cloud-targetingdevice-code-phishingespionageidentity-abuserdp-filesrussia-nexusspearphishingsupply-chain-attacksvr

About APT29.

A hacker group linked to Russia's Foreign Intelligence Service (SVR), known for sophisticated and persistent tactics.

Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.