Threat Actor Profile
Description
APT29is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2]They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks.APT29reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6] In April 2021, the US and UK governments attributed theSolarWinds Compromiseto the SVR; public statements included citations toAPT29, Cozy Bear, and The Dukes.[7][8]Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
Confidence Score
Tags
First Seen
Unknown
Last Updated
April 29, 2026
18 hours, 42 minutes ago
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (70)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': [],
'description': "APT29is threat group that has been attributed to Russia's "
'Foreign Intelligence Service (SVR).[1][2]They have operated '
'since at least 2008, often targeting government networks in '
'Europe and NATO member countries, research institutes, and '
'think tanks.APT29reportedly compromised the Democratic '
'National Committee starting in the summer of '
'2015.[3][4][5][6] In April 2021, the US and UK governments '
'attributed theSolarWinds Compromiseto the SVR; public '
'statements included citations toAPT29, Cozy Bear, and The '
'Dukes.[7][8]Industry reporting also referred to the actors '
'involved in this campaign as UNC2452, NOBELIUM, '
'StellarParticle, Dark Halo, and '
'SolarStorm.[9][10][11][12][13][14]',
'external_references': [{'external_id': 'G0016',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0016/'}],
'id': 'threat-actor--G0016',
'metadata': {'crawled_at': '2026-04-29T14:32:41.720571+00:00',
'mitre_group_id': 'G0016',
'page_title': 'APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, '
'Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, '
'Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, '
'UNC3524, Midnight Blizzard, Group G0016 | MITRE '
'ATT&CK®'},
'name': 'APT29',
'type': 'threat-actor'}