APT29 – Cozy Bear: Russia's Ghost in Every Network

TLP: AMBER — Share only with members of your organization and trusted partners. Do not publish publicly.

APT29 is not just a hacker group — it is a patient, methodical intelligence operation run by the Russian Foreign Intelligence Service (SVR). Where other threat actors smash through doors, APT29 picks the lock, steps inside, and lives in your network for months — sometimes years — before you ever notice.

Active since at least 2008, this group has successfully breached some of the most hardened targets on the planet: the U.S. State Department, the Democratic National Committee, SolarWinds, Microsoft, and HPE — to name only the publicly confirmed cases. Their intrusions consistently go undetected for extended periods, and their tradecraft evolves faster than most defenses can adapt.

⚠ Why This Actor Demands Your Attention

APT29 specifically hunts cybersecurity teams, legal departments, and executive leadership — targeting the very people responsible for catching them. If your organization handles government contracts, conducts policy research, or operates in the defense or energy sectors, consider yourself a potential target.

Imagine a burglar who doesn't steal your television. Instead, they slip into your home, read your mail, listen to your conversations, and leave without a trace — returning night after night for years. That is APT29.

Unlike financially motivated cybercriminals, APT29 has no interest in ransomware paydays or credit card theft. Their currency is intelligence. They want to know what your government is planning, who your diplomats are meeting with, what technologies your research teams are developing, and — crucially — what your cybersecurity team knows about them.

The Dutch AIVD famously obtained footage of the group operating from inside a Moscow university building, confirming direct ties to Russian intelligence. But APT29's sophistication goes far beyond their institutional backing: they continuously update their tooling, adopt novel living-off-the-land techniques, and tailor every campaign to their specific victim's environment. They don't use the same playbook twice.

1. Initial Access — Getting Their Foot in the Door

APT29's preferred entry point is the trusted inbox. Their spear phishing campaigns are meticulously crafted — sometimes impersonating Ministry of Foreign Affairs invitations to wine tasting events, other times masquerading as IT helpdesk alerts. The objective is always the same: trick a high-value user into executing a payload.

When phishing isn't enough, they exploit unpatched vulnerabilities in internet-facing systems. They are known to acquire zero-days and will leverage vulnerability windows between disclosure and patching aggressively.

2. Credential Theft & Cloud Intrusion

APT29 has shifted heavily toward cloud infrastructure in recent years. Their primary technique involves password spraying — firing low-and-slow login attempts across thousands of accounts from rotating IP addresses, staying below detection thresholds. Once a foothold is gained, they pivot to cloud tenants.

A particularly insidious technique involves the abuse of OAuth applications: APT29 creates or hijacks OAuth apps and grants them broad permissions — including access to Exchange Online mailboxes — allowing them to silently vacuum emails and attachments without triggering standard credential alerts.

3. Persistence — Making Themselves at Home

The moment APT29 lands in a cloud environment, they begin establishing long-term footholds. They register their own devices to cloud tenants, so even if credentials are rotated or compromised sessions revoked, they maintain access through a trusted device. They plant multiple persistence hooks — scheduled tasks, WMI subscriptions, and backdoor service accounts — ensuring that removing one rarely removes them.

4. Defense Evasion — Hiding in Plain Sight

Perhaps no other group is as deliberate about remaining invisible. APT29 routes C2 traffic through residential proxy networks, making malicious connections appear to originate from legitimate home ISP addresses. They use HTTPS for all communications, blend into normal cloud service traffic, and leverage legitimate tools like PsExec, WMI, and native cloud APIs to avoid triggering endpoint detection signatures.

They also target the defenders themselves: in the 2024 Microsoft breach, APT29 specifically sought information about what Microsoft's security teams knew about their own infrastructure — intelligence that would help them refine future operations.

APT29 maintains a custom, regularly updated toolkit. Unlike commodity malware, their tools are bespoke — developed in-house and frequently retooled between campaigns to evade signature-based detection.

The following table chronicles APT29's most significant confirmed operations. Each represents not just a technical intrusion, but a strategic intelligence collection effort with geopolitical implications.

Detecting APT29 is extraordinarily difficult by design. Their evasion techniques are sophisticated, and they specifically study and adapt to the defenses of their targets. That said, the following indicators and behavioral patterns provide detection opportunities.

⚠ Critical Detection Note

Do not rely solely on IP-based detection. APT29 extensively uses residential proxies, Tor, and legitimate cloud infrastructure to route traffic. Host-based and application-layer logging are significantly more reliable for detection than network flow analysis.

Behavioral Indicators (High Confidence)

• Unusual OAuth application registrations with broad mailbox access permissions (EWS, Mail.Read, Mail.ReadWrite)
• New device registrations in cloud tenants from unknown or unmanaged devices, particularly shortly after successful authentication
• Low-volume password spray patterns across many accounts over days or weeks — watch for distributed source IPs, especially residential ISP ranges
• Service accounts or system accounts authenticating to cloud resources outside business hours or from unusual geolocations
• DLL side-loading events involving legitimate signed binaries loading unexpected DLLs from user-writable directories
• Unusual volume of Exchange Web Services API calls, especially to legacy endpoints from non-standard clients

Network & Infrastructure Indicators

• C2 communications over HTTPS to cloud provider infrastructure (Azure, AWS, GCP) — APT29 frequently uses legitimate cloud services as proxies
• DNS over HTTPS or DNS tunneling patterns to unusual domains with high-entropy subdomains
• Traffic to residential ISP ranges that does not correspond to legitimate remote work activity

No single control will stop a nation-state actor. Defense in depth is the only viable strategy. The following controls address APT29's known TTPs and are prioritized by impact.

Identity & Access Management

• Enforce phishing-resistant MFA (FIDO2/hardware tokens) on all accounts, especially privileged and executive accounts. SMS/TOTP MFA is insufficient against this actor.
• Implement Conditional Access Policies requiring device compliance checks. This directly counters APT29's device registration persistence technique.
• Disable legacy authentication protocols (Basic Auth, NTLM where possible) across all cloud services.
• Regularly audit and revoke unused OAuth application consents. Set up alerts for new OAuth registrations requesting sensitive Graph API scopes.

Cloud Security

• Enable Unified Audit Logging in Microsoft 365 and ensure logs are shipped to a SIEM with sufficient retention (minimum 12 months).
• Monitor for and alert on new device registrations in Entra ID / Azure AD, particularly from non-compliant or unknown devices.
• Implement Microsoft Purview or equivalent DLP tooling to detect unusual bulk email access or export via API.

Endpoint & Network

• Deploy EDR solutions with behavioral detection enabled — signature-based AV will not catch APT29's custom tooling.
• Hunt for DLL side-loading activity involving signed binaries such as OneDrive, Dropbox, or other trusted applications loading unexpected DLLs.
• Establish a network baseline and alert on anomalous outbound connections from servers and workstations, particularly to cloud storage providers.

Intelligence & Response

• Subscribe to relevant ISACs and government threat feeds (CISA, NCSC UK, CERT EU) for APT29-specific IOCs and advisories.
• Conduct regular threat hunting exercises specifically focused on living-off-the-land techniques and cloud persistence.
• Test your incident response capability against nation-state scenarios. APT29 intrusions often require specialized forensic capabilities in cloud environments.

• MITRE ATT&CK G0016
• CISA Advisory AA24-057A
• CISA Advisory AA20-352A
• Check Point — GRAPELOADER/WINELOADER (2025)
• NCSC UK — APT29 COVID-19 Advisory