D
CyberRussia

APT29

State-sponsored cyber threat groupActivePending verification

Also known as: Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, UNC2452

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsCozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, UNC2452
ProliferationOrigin country only
Active since2008At least 2008Med[1]
MITRE ATT&CK IDG0016High[1]
Attribution and activity
Attributed sponsorRussia's Foreign Intelligence Service (SVR)Med[1]
TargetsGovernment networks in Europe and NATO member countries, research institutes, think tanksMed[1]
Notable activityDemocratic National Committee compromise (from 2015); SolarWinds Compromise (C0024, 2019–2021); Operation Ghost (C0023, 2013–2019)Med[1]
Summary

Threat group attributed to Russia's Foreign Intelligence Service (SVR). The U.S. and UK governments linked it to the SolarWinds supply chain compromise in 2021.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. APT29, Group G0016, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-10-05
Change log
  • 2026-10-05 Entry created from MITRE ATT&CK (group page version 6.2)