APT29
Alias-Namen: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard
22
22
01.08.2026
21.10.2026
Profil laut MITRE ATT&CK
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.
Vollständiges MITRE-ProfilBeschreibung und Alias-Namen stammen aus MITRE ATT&CK®.
Nennungen im Zeitverlauf
Meldungen je Monat, letzte 12 Monate.
Beobachtete Techniken
ATT&CK-Techniken, die in denselben Meldungen benannt sind — nicht das vollständige MITRE-Repertoire.
MITRE ordnet 47 Techniken zu; 4 davon kommen in unseren Meldungen vor. Markiert: auch laut MITRE bekannt.
T1566 Phishing
Initial Access
T1684 Social Engineering
stealth
T1557 Adversary-in-the-Middle
Credential Access · Collection
T1669 Wi-Fi Networks
Initial Access
T1056.001 Keylogging
Credential Access · Collection
T1219 Remote Access Tools
Command & Control
T1505.003 Web Shell
Persistence
T1583.008 Malvertising
Resource Development
T1608.006 SEO Poisoning
Resource Development
T1656 Impersonation
Defense Evasion
T1014 Rootkit
stealth
T1036 Masquerading
stealth
Schwachstellen im selben Kontext
CVEs, die in denselben Meldungen auftauchen. Ko-Okkurrenz, kein Nachweis einer Ausnutzung.
Gemeinsam genannt
Betroffene Branchen
Meldungen
ClickFix has never been bigger, and AI tools are its most convincing lure yet
TeamViewer urges users to patch severe flaws “as soon as possible”
Know Your Enemy: Browser-Based Attack Techniques in 2026
CISA: Ransomware gangs now exploiting critical TeamCity flaw
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Hackers abused Claude to extract secrets from 1.8M Android apps
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Your Cloud Security Checklist Doesn't Work the Way You Think It Does
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
CYFIRMA reports telecom sector faces high cyber risk as China, Russia-linked APT campaigns intensify
Hackers breached over 270 Zimbra servers in ongoing attacks
CISA orders urgent patching of actively exploited Zimbra flaw
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Identity Abuse Through Trusted Communication Channels
Critical Zimbra RCE flaw now actively exploited in attacks
Red Team vs Penetration Testing: Key Differences
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Quellen: BleepingComputer (8), The Hacker News (8), SecurityWeek (2), Unit 42 (2), Industrial Cyber (1), IOActive (1)
Alle Angaben auf dieser Seite stammen aus dem Alias-Abgleich der Meldungstexte gegen den MITRE-ATT&CK-Katalog. Beziehungen entstehen rein statistisch: Zwei Einträge gelten als verbunden, wenn sie in derselben Meldung benannt sind. Das ist keine eigenständige Attribution durch SecBoard, und eine Nennung ist kein Nachweis einer Täterschaft. Ausnahme ist der Abschnitt „Belegte Beziehungen“: dort sagt die Meldung die Beziehung ausdrücklich, mit Zitat.