APT29
Group 100COZY BEARThe DukesMinidionisSeaDukeYTTRIUMIRON HEMLOCKGrizzly SteppeG0016ATK7Cloaked UrsaTA421Blue KitsuneITG11BlueBravoNobelium
A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets,… Source: MISP
Attributed country: RU according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 4 Nov 2026 · last seen on 4 Nov 2026
News
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android ExploitsThe Hacker News · 4 Nov 2026
MITRE ATT&CK techniques
Reconnaissance
Resource Development
T1583.006Web ServicesT1586.002Email AccountsT1586.003Cloud Accounts 1 Sigma rulesT1587.001Malware 10 Sigma rulesT1587.003Digital CertificatesT1588.002Tool 7 Sigma rules
Initial Access
T1078Valid Accounts 82 Sigma rulesT1078.003Local Accounts 4 Sigma rulesT1078.004Cloud Accounts 35 Sigma rulesT1133External Remote Services 17 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1199Trusted Relationship 1 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rulesT1566.003Spearphishing via Service
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.006Python 10 Sigma rulesT1059.009Cloud API 3 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1651Cloud Administration Command
Persistence
T1037Boot or Logon Initialization Scripts 3 Sigma rulesT1037.004RC ScriptsT1098.002Additional Email Delegate PermissionsT1098.005Device Registration 1 Sigma rulesT1136.003Cloud Account 1 Sigma rulesT1505.003Web Shell 33 Sigma rulesT1546.003Windows Management Instrumentation Event Subscription 11 Sigma rulesT1546.008Accessibility Features 6 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rulesT1556.007Hybrid Identity
Privilege Escalation
T1068Exploitation for Privilege Escalation 28 Sigma rulesT1548.002Bypass User Account Control 40 Sigma rules
Credential Access
T1003.002Security Account Manager 26 Sigma rulesT1003.004LSA Secrets 12 Sigma rulesT1110.001Password Guessing 2 Sigma rulesT1110.003Password SprayingT1528Steal Application Access Token 13 Sigma rulesT1621Multi-Factor Authentication Request Generation 2 Sigma rulesT1649Steal or Forge Authentication Certificates 4 Sigma rules
Discovery
Lateral Movement
Collection
Command and Control
T1090.002External Proxy 2 Sigma rulesT1090.003Multi-hop Proxy 3 Sigma rulesT1090.004Domain FrontingT1105Ingress Tool Transfer 40 Sigma rulesT1568Dynamic Resolution 4 Sigma rulesT1573Encrypted Channel 5 Sigma rulesT1665Hide Infrastructure
Stealth
T1027.001Binary Padding 2 Sigma rulesT1027.002Software PackingT1027.006HTML SmugglingT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070.004File Deletion 9 Sigma rulesT1070.006Timestomp 4 Sigma rulesT1218.005Mshta 8 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗