{
  "id": "apt29",
  "name": "APT29",
  "aliases": [
    "Cozy Bear",
    "Midnight Blizzard",
    "NOBELIUM",
    "The Dukes",
    "UNC2452"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "State-sponsored cyber threat group",
  "status": "active",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Threat group attributed to Russia's Foreign Intelligence Service (SVR). The U.S. and UK governments linked it to the SolarWinds supply chain compromise in 2021.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russia's Foreign Intelligence Service (SVR)",
      "src": [
        "mitre-g0016"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2008,
      "src": [
        "mitre-g0016"
      ],
      "conf": "medium",
      "note": "At least 2008"
    },
    {
      "k": "attack_id",
      "v": "G0016",
      "src": [
        "mitre-g0016"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Government networks in Europe and NATO member countries, research institutes, think tanks",
      "src": [
        "mitre-g0016"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "Democratic National Committee compromise (from 2015); SolarWinds Compromise (C0024, 2019–2021); Operation Ghost (C0023, 2013–2019)",
      "src": [
        "mitre-g0016"
      ],
      "conf": "medium"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "changelog": [
    {
      "date": "2026-10-05",
      "change": "Entry created from MITRE ATT&CK (group page version 6.2)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt29.html",
  "sources": {
    "mitre-g0016": {
      "title": "APT29, Group G0016",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0016/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-10-05"
    }
  }
}