APT29

☆ pin

MITRE G0016Also known as Midnight Blizzard, BlueBravo, Cloaked Ursa, Storm-2945, Cozy Bear

Reports

First seen

Oct 3, 2024

Last seen

Oct 8, 2026

Motivation

Espionage

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Hospitality ×1 Other ×1 Government ×1 Technology ×1

Victim regions

×1

×2

United States×2

Ukraine×2

Japan×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×15T1190 Exploit Public-Facing Application ×11T1078 Valid Accounts ×9T1041 Exfiltration Over C2 Channel ×9T1059 Command and Scripting Interpreter ×8T1598 Phishing for Information ×6T1005 Data from Local System ×5T1003 OS Credential Dumping ×5T1110 Brute Force ×5T1555 Credentials from Password Stores ×5T1021 Remote Services ×5T1547 Boot or Logon Autostart Execution ×4

Indicators

cve ×166domain ×16filename ×8url ×3ip_v4 ×1

Indicator values are available on Pro and via the API.

Recent reports

unrated

APT29

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Japan Adopts Proactive Cyber Defense Strategy Amid China, Russia, and North Korea Threats

CISA: Ransomware gangs now exploiting critical TeamCity flaw

Weekly Recap: AI Agents in Attacks, RubyGems Compromise, WeChat Worm, PaperCut Exploitation

Hackers abused Claude AI to extract secrets from 1.8M Android apps

Anthropic disrupts Russia-linked spies using Claude for hacking operations

AI enables small actors to conduct state-level hacking campaigns, Anthropic report finds

CERT-EU Cyber Brief August 2026: Espionage, Ransomware, and Supply-Chain Compromises

CISA orders urgent patching of actively exploited Zimbra flaw

Identity Abuse Through Trusted Communication Channels

Critical Zimbra RCE flaw now actively exploited in attacks

Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

Weekly Cybersecurity Recap: AI Model Breaches, Water-System Attacks, Ransomware, and Critical Vulnerabilities

Zimbra urges customers to patch critical web client XSS flaw

Microsoft Teams Impersonation: IT Phishing via Collaboration Tools

ThreatsDay Bulletin: AI Agents, C2 Tools, ClickFix, JS Backdoors & 20+ Security Stories

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

ROADtools and Nation-State Cloud Attacks: Persistence, Evasion, and Discovery Techniques

Preparing for Russia's New Generation Warfare in NATO Territory

Rising Supply Chain Attacks on Cybersecurity Ecosystems

CERT-EU Cyber Brief September 2025 – Multi-Sector Threats Across Europe

Hunting for M365 Password Spraying