APT29
Group 100COZY BEARThe DukesMinidionisSeaDukeYTTRIUMIRON HEMLOCKGrizzly SteppeG0016ATK7Cloaked UrsaTA421Blue KitsuneITG11BlueBravoNobelium
A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets,… Fuente: MISP
País atribuido: RU según MISP
Actividad en Jábega · 12 semanas
1 noticias · vista por primera vez el 4 nov 2026 · la última, el 4 nov 2026
Noticias
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android ExploitsThe Hacker News · 4 nov 2026
Técnicas MITRE ATT&CK
Reconocimiento
Preparación de recursos
T1583.006Web ServicesT1586.002Email AccountsT1586.003Cloud Accounts 1 reglas SigmaT1587.001Malware 10 reglas SigmaT1587.003Digital CertificatesT1588.002Tool 7 reglas Sigma
Acceso inicial
T1078Valid Accounts 82 reglas SigmaT1078.003Local Accounts 4 reglas SigmaT1078.004Cloud Accounts 35 reglas SigmaT1133External Remote Services 17 reglas SigmaT1190Exploit Public-Facing Application 40 reglas SigmaT1199Trusted Relationship 1 reglas SigmaT1566.001Spearphishing Attachment 21 reglas SigmaT1566.002Spearphishing Link 3 reglas SigmaT1566.003Spearphishing via Service
Ejecución
T1047Windows Management Instrumentation 40 reglas SigmaT1053.005Scheduled Task 40 reglas SigmaT1059.001PowerShell 40 reglas SigmaT1059.006Python 10 reglas SigmaT1059.009Cloud API 3 reglas SigmaT1203Exploitation for Client Execution 31 reglas SigmaT1204.001Malicious Link 4 reglas SigmaT1204.002Malicious File 32 reglas SigmaT1651Cloud Administration Command
Persistencia
T1037Boot or Logon Initialization Scripts 3 reglas SigmaT1037.004RC ScriptsT1098.002Additional Email Delegate PermissionsT1098.005Device Registration 1 reglas SigmaT1136.003Cloud Account 1 reglas SigmaT1505.003Web Shell 33 reglas SigmaT1546.003Windows Management Instrumentation Event Subscription 11 reglas SigmaT1546.008Accessibility Features 6 reglas SigmaT1547.001Registry Run Keys / Startup Folder 38 reglas SigmaT1556.007Hybrid Identity
Escalada de privilegios
T1068Exploitation for Privilege Escalation 28 reglas SigmaT1548.002Bypass User Account Control 40 reglas Sigma
Acceso a credenciales
T1003.002Security Account Manager 26 reglas SigmaT1003.004LSA Secrets 12 reglas SigmaT1110.001Password Guessing 2 reglas SigmaT1110.003Password SprayingT1528Steal Application Access Token 13 reglas SigmaT1621Multi-Factor Authentication Request Generation 2 reglas SigmaT1649Steal or Forge Authentication Certificates 4 reglas Sigma
Descubrimiento
Movimiento lateral
Recopilación
Mando y control
T1090.002External Proxy 2 reglas SigmaT1090.003Multi-hop Proxy 3 reglas SigmaT1090.004Domain FrontingT1105Ingress Tool Transfer 40 reglas SigmaT1568Dynamic Resolution 4 reglas SigmaT1573Encrypted Channel 5 reglas SigmaT1665Hide Infrastructure
Stealth
T1027.001Binary Padding 2 reglas SigmaT1027.002Software PackingT1027.006HTML SmugglingT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1070.004File Deletion 9 reglas SigmaT1070.006Timestomp 4 reglas SigmaT1218.005Mshta 8 reglas Sigma
Defense impairment
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗