Threat Actor π·πΊ Russia
APT29
Also known as: Group 100 Β· COZY BEAR Β· The Dukes Β· Minidionis Β· SeaDuke Β· YTTRIUM Β· IRON HEMLOCK Β· Grizzly Steppe Β· G0016 Β· ATK7 Β· Cloaked Ursa Β· TA421 Β· Blue Kitsune Β· ITG11 Β· BlueBravo Β· Nobelium Β· UAC-0029
A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '
Indicators of Compromise 31
Domain ClickFix Domain actor-owned-service[.]com Domain decoraat[.]net Domain hooks[.]slack[.]com Domain onedown[.]gesecole[.]net Filename AVK.exe Filename AVKTray.dat Filename Avk.dll Filename Cloud Sync Service Filename CloudSyncSvc Filename DarkSword Filename FruitStone Filename GiftDrop Filename Invitation_Letter_No.02_2026.csproj Filename Invitation_Letter_No.02_2026.exe Filename MiniPlasma Filename PowerChrome Filename SECOMS64 Filename WUEngine Filename al-Najm al-thΔqib Filename lpk.dll GitHub Repo axios SHA-256 29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad SHA-256 46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc SHA-256 5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc SHA-256 6df8649bf4e233ee86a896ee8e5a3b3179c168ef927ac9283b945186f8629ee7 SHA-256 7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b176 SHA-256 8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99 SHA-256 d293ded5a63679b81556d2c622c78be6253f500b6751d4eeb271e6500a23b21e SHA-256 de8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1 Package axios
MITRE ATT&CK TTPs 38
T1003 T1021.001 T1027 T1036 T1036.005 T1053.005 T1055 T1055.001 T1056.001 T1056.002 T1059.001 T1059.003 T1068 T1070.004 T1070.006 T1071.001 T1071.004 T1078 T1090 T1105 T1110 T1133 T1136.001 T1185 T1204.002 T1222.002 T1480 T1495 T1556 T1558 T1566 T1566.001 T1570 T1586 T1588 T1595.002 T1659 T1684.001
OS Credential Dumping
Credential Access
Remote Desktop Protocol
Lateral Movement
Obfuscated Files or Information
Defense Evasion
Masquerading
Defense Evasion
Match Legitimate Name or Location
Defense Evasion
Scheduled Task
Execution
Process Injection
Defense Evasion
Dynamic-link Library Injection
Defense Evasion
Keylogging
Collection
GUI Input Capture
Collection
PowerShell
Execution
Windows Command Shell
Execution
Exploitation for Privilege Escalation
Privilege Escalation
File Deletion
Defense Evasion
Timestomp
Defense Evasion
Web Protocols
Command And Control
DNS
Command And Control
Valid Accounts
Defense Evasion
Proxy
Command And Control
Ingress Tool Transfer
Command And Control
Brute Force
Credential Access
External Remote Services
Persistence
Local Account
Persistence
Browser Session Hijacking
Collection
Malicious File
Execution
Linux and Mac File and Directory Permissions Modification
Defense Evasion
Execution Guardrails
Defense Evasion
Firmware Corruption
Impact
Modify Authentication Process
Credential Access
Steal or Forge Kerberos Tickets
Credential Access
Phishing
Initial Access
Spearphishing Attachment
Initial Access
Lateral Tool Transfer
Lateral Movement
Compromise Accounts
Resource Development
Obtain Capabilities
Resource Development
Vulnerability Scanning
Reconnaissance
Content Injection
Initial Access
T1684.001
Source Articles
TeamViewer urges users to patch severe flaws βas soon as possibleβ
TeamViewer has disclosed and patched five high-severity vulnerabilities in its Full Client and Host software for Windows, Linux, and macOS. The most critical flaw, CVE-2026-92370, is a remote session access control bypass that could allow unauthorized remote code execution. The other vulnerabilities include a path traversal, a heap-based buffer overflow, a TOCTOU race condition, and improper path validation, all of which could enable local attackers to achieve remote code execution or privilege escalation. Although there is no evidence of active exploitation or public exploit code, TeamViewer strongly urges users to update to version 15.82 to mitigate potential risks.
bleeping-computer Β·3w ago
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that ransomware gangs are actively exploiting a critical authentication bypass vulnerability in JetBrains TeamCity, tracked as CVE-2026-63077. This flaw allows unauthenticated attackers to execute arbitrary operating system commands via the TeamCity agent polling protocol, potentially compromising CI/CD pipelines, stealing credentials, and modifying server state. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate within three days. Although patching is available, hundreds of internet-exposed TeamCity servers remain unpatched, making them attractive targets for ransomware and state-sponsored actors.
bleeping-computer Β·4w ago
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic identified multiple threat actors, dubbed Generative Threat Groups (GTGs), leveraging its Claude AI models to automate cyber attacks, including reconnaissance, exploitation, and data exfiltration. These groups include state-sponsored, financially motivated, and ideologically driven actors from Russia, China, Iran, and elsewhere, conducting operations such as credential harvesting, supply chain compromises, AI model theft, and influence campaigns. Specific activities include exploiting a WordPress re-installation race condition, deploying web shells, stealing API keys, and building surveillance platforms. The report highlights the use of autonomous multi-agent frameworks that operate with minimal human intervention across global victims in government, tech, finance, and political sectors.
hacker-news Β·1mo ago
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Russian state-sponsored threat actor GTG-20006, linked to APT29 (Cozy Bear), has been using AI platform Claude to automate the rebuilding of malware upon detection, enabling evasion of static security defenses. The group targets Ukrainian and European government, diplomatic, defense, and U.S. foreign policy-related entities through a multi-platform toolkit including Windows, Android, and iOS malware delivered via phishing, DNS hijacking, and ClickFix lures. The actor abuses AI to dynamically modify malware, register domains, manage infrastructure, and monitor command-and-control channels, while also exploiting stolen data from compromised hotel Wi-Fi systems and surveillance platforms to identify and target high-value individuals.
hacker-news Β·1mo ago
Identity Abuse Through Trusted Communication Channels
Threat actors are increasingly exploiting trusted enterprise collaboration platforms such as Microsoft Teams and Slack to conduct identity phishing, impersonation, credential theft, and malware delivery. These attacks leverage the inherent trust in authenticated communication channels to bypass traditional security controls, using techniques like external federation abuse, social engineering, and malicious third-party integrations. Real-world incidents include APT29 using compromised Teams accounts to distribute credential-harvesting links, a North Korea-linked campaign impersonating Fireblocks during fake job interviews to deliver malware via npm install, and attackers poisoning the Axios npm package by compromising a maintainer through a spoofed Slack environment. Additionally, attackers have used legitimate Slack webhook integrations on compromised appliances to exfiltrate credentials, demonstrating post-compromise persistence through trusted SaaS channels.
unit42 Β·2mo ago
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts
Microsoft has identified a global campaign dubbed CaptiveCrunch, attributed to the Russian threat actor Midnight Blizzard (also known as APT29 or Storm-2945), targeting hotel and conference center Wi-Fi networks. The attackers manipulate DNS settings on captive portal equipment to redirect users to phishing pages impersonating Microsoft 365 login portals or abusing Microsoft Entra ID device code authentication flows. They also deploy custom malware, including the Go-based RAT CornFlake and the PowerShell-based ChocoShell, to steal credentials, session tokens, and conduct surveillance. A previously undisclosed tactic involves fake OS and browser update prompts (ClickFix) delivering malware to Windows and Android devices.
bleeping-computer Β·2mo ago
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
A threat actor dubbed Storm-2945, assessed to be a sub-cluster of the Russian state-sponsored group APT29 (aka Cozy Bear), has hijacked hotel Wi-Fi networks to deliver a surveillance-focused remote access trojan named CornFlake. The attack abuses compromised captive portals to redirect users to fake browser or OS update prompts, which lead to the download of malicious payloads. The CornFlake malware, written in Go, establishes persistence via registry run keys and scheduled tasks, captures keystrokes, screenshots, microphone audio, and browser credentials, and can bypass Chrome's App-Bound Encryption. A related in-memory PowerShell stealer, ChocoShell, harvests Microsoft 365, Azure AD, and WAM tokens from the Token Broker cache. Attackers also leveraged Microsoft's device code authentication flow to gain MFA-satisfied access by tricking users into approving malicious sessions.
hacker-news Β·2mo ago
PlugX Meeting Invitation via MSBuild and GDATA
A recent PlugX RAT campaign leverages a spear-phishing email with the subject 'Meeting Invitation' to deliver malicious payloads via DLL side-loading. The infection chain uses a legitimate G DATA antivirus executable (Avk.exe) to load a malicious DLL (Avk.dll), which decrypts and executes the payload from AVKTray.dat. The malware establishes persistence through a registry Run key and communicates with the C2 server at decoorat[.]net over HTTPS on port 443. The campaign demonstrates continued use of trusted binaries, XOR-based obfuscation, and API hashing techniques consistent with China-aligned threat actors.
lab52 Β·8mo ago
Zimbra urges customers to patch critical web client XSS flaw
Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.
bleeping-computer Β·3mo ago