APT29 (Cozy Bear): Cloud Espionage & Long-Term Persistence

Updated: September 2026

The quick answer

APT29 is a Russian state-sponsored cyber espionage group run by the SVR, Russia's Foreign Intelligence Service, and tracked in MITRE ATT&CK as G0016. Also called Cozy Bear, Midnight Blizzard, Nobelium, and The Dukes, it has operated since at least 2008. APT29 is known for the SolarWinds supply chain attack and the 2024 Microsoft breach, and for quiet, cloud-focused intelligence collection that can sit inside a network for months.

What is APT29?

APT29 is one of the two Russian intelligence services that dominate high-end cyber espionage, the other being the GRU-run APT28 (Fancy Bear). Where GRU operations often lean toward disruption and leaks, APT29 works for the SVR and behaves like a foreign intelligence service that happens to use code: patient, quiet, and focused on stealing information rather than breaking things.

The group's mission is strategic intelligence collection. Its targets are governments, diplomatic missions, think tanks, defense contractors, NGOs, and the IT and cloud providers that serve them. The United States and United Kingdom have formally attributed APT29 to the SVR, and Microsoft, which tracks the group as Midnight Blizzard, describes its objectives as "longstanding and dedicated espionage of foreign interests." APT29 is a fixture of the state-sponsored APT threat landscape and one of the most capable actors most defenders will ever face.

What sets APT29 apart is discipline. It picks a small number of high-value accounts, uses a low volume of attempts to stay under alerting thresholds, routes traffic through residential proxies so it looks like normal users, and cleans up after itself. The result is long dwell time, months or years of access before anyone notices.

The names of Cozy Bear

Because different vendors discovered APT29 activity independently, the group carries a long list of aliases. They all refer to the same SVR actor.

The naming matters for defenders reading threat reports. A CISA advisory calling the actor "SVR cyber actors," a Microsoft blog naming "Midnight Blizzard," and a Mandiant report on "UNC2452" can all describe the same intrusion set. The primary keyword to search on remains APT29 Cozy Bear, but any of these names should raise the same alarm.

Major APT29 campaigns

APT29's history is a timeline of some of the most consequential espionage operations of the last decade.

SolarWinds and SUNBURST (2020)

The SolarWinds compromise is APT29's signature operation. The group breached software maker SolarWinds and inserted a backdoor, known as SUNBURST, into legitimate, digitally signed updates of the Orion network monitoring platform. Around 18,000 organizations installed the trojanized update, and APT29 then hand-picked roughly 100 high-value victims for follow-on intrusion, including nine US federal agencies. The operation was disclosed by Mandiant in December 2020, and in April 2021 the US government and the UK NCSC formally attributed it to the SVR. It remains a defining example of a supply chain attack: compromise one trusted vendor, and you inherit the trust of all its customers.

DNC intrusion (2015 to 2016)

APT29 was inside the Democratic National Committee network from at least summer 2015, months before APT28 arrived. Cozy Bear's role was classic espionage, quiet collection, in contrast to the leak-and-influence operation that followed. The episode showed how the two Russian services operate against the same target with different goals.

COVID-19 vaccine research (2020)

During the pandemic, APT29 targeted vaccine research organizations in the US, UK, and Canada using custom malware families named WellMess and WellMail. A joint advisory from the UK NCSC, CISA, and Canada's CSE attributed the activity to the SVR. The goal was to steal research and development data, again pure intelligence value.

The Microsoft and enterprise breaches (2023 to 2024)

In January 2024 Microsoft disclosed that Midnight Blizzard had breached its own corporate email, reading messages belonging to senior leadership and to its cybersecurity and legal teams. The same actor breached Hewlett Packard Enterprise's cloud email environment and, in mid-2024, remote access vendor TeamViewer's corporate IT network. These incidents mark APT29's decisive pivot into cloud and identity, covered in detail below.

Diplomatic phishing: WINELOADER and GRAPELOADER (2024 to 2025)

Alongside cloud operations, APT29 runs a long-running spear-phishing campaign against European diplomats using wine-tasting invitation lures. In early 2024, Zscaler documented a modular backdoor called WINELOADER, delivered through DLL side-loading, in attacks that hit German political parties. In 2025, Check Point Research reported a new initial-stage loader named GRAPELOADER that replaced the group's older ROOTSAW downloader, delivered inside a wine.zip archive that abuses a legitimate signed executable to side-load malicious code, establishes registry persistence, and beacons to its command server every 60 seconds before pulling down an updated WINELOADER variant. The campaign shows APT29 still invests heavily in stealthy, tailored malware even as it leans on identity attacks.

The rogue RDP campaign (October 2024)

On October 22, 2024, Microsoft observed Midnight Blizzard sending thousands of spear-phishing emails to over 100 organizations across government, academia, defense, and NGOs, concentrated in the UK, Europe, Australia, and Japan. The novel twist was a signed Remote Desktop Protocol configuration file that, once opened, mapped the victim's local drives, clipboard, and even authentication features to an attacker-controlled server. Ukraine's CERT-UA tracked the same activity as UAC-0215.

APT29's shift to cloud espionage

The most important trend in APT29's tradecraft is its move away from planting malware on endpoints and toward abusing the identity layer of cloud environments. As organizations moved email and files to Microsoft 365 and similar platforms, APT29 followed the data. A February 2024 joint advisory from CISA and international partners, "SVR cyber actors adapt tactics for initial cloud access," laid out the playbook, and the Microsoft breach demonstrated it end to end.

The pattern relies on stolen or guessed credentials rather than exploits. APT29 favors living off the land, using legitimate administrative tools and native cloud features so its activity blends into normal traffic. Its cloud and identity techniques include:

• Password spraying and brute force against accounts that lack strong authentication, especially dormant, legacy, and service accounts.
• Abuse of OAuth applications and service principals to gain durable, token-based access to mailboxes and data that survives a password reset.
• MFA request bombing to wear down users into approving a push, and theft of session tokens to bypass multifactor prompts entirely.
• Golden SAML and federation abuse, including the AD FS malware families FoggyWeb and MagicWeb, to forge authentication tokens for any user.
• Residential proxy infrastructure to make malicious sign-ins look like ordinary consumer traffic, defeating simple IP-based detection.

This is why APT29 is so hard to catch. There is often no exploit, no dropped file, and no obvious anomaly, just a valid login from a normal-looking address using a legitimately consented application.

An APT29 attack, step by step

The 2024 Microsoft breach is the clearest public case study of how APT29 turns a single weak account into cloud-wide email access.

1. Password spray. Beginning in late November 2023, APT29 ran a low-and-slow password spray, launched from residential proxies, against a small set of accounts to avoid lockouts and alerts.
2. Foothold on a forgotten account. The spray succeeded against a legacy, non-production test tenant account that did not have MFA enabled. A single un-hardened account, left over from old work, was the way in.
3. Discover a privileged application. That account had access to a legacy test OAuth application with elevated permissions into Microsoft's corporate environment.
4. Build durable access. APT29 created additional malicious OAuth applications and a new user account to consent to them, then used the legacy app to grant itself the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes.
5. Collect intelligence. Using those applications, the group authenticated to Exchange Online and read email from senior leadership and from the security and legal teams, initially hunting for what Microsoft knew about APT29 itself.
6. Persist and evade. Because access ran through consented applications and residential proxies, traditional indicator-based detection failed, and the intrusion went unnoticed from November until January 12, 2024.

No malware was needed on a Microsoft endpoint. The entire operation ran on valid accounts, consented apps, and native cloud APIs.

APT29 tactics, malware, and MITRE ATT&CK techniques

APT29's MITRE ATT&CK group ID is G0016. The techniques below recur across its campaigns and make a useful detection checklist. Searching for "APT29 MITRE" will surface the full technique catalog; these are the ones that matter most operationally.

Its malware arsenal spans both eras: SUNBURST, TEARDROP, GoldMax, GoldFinder, Sibot, and the AD FS implants FoggyWeb and MagicWeb from the SolarWinds period, plus WellMess, WellMail, ROOTSAW, WINELOADER, and GRAPELOADER from its diplomatic phishing campaigns.

How to defend against APT29

APT29 attacks the identity layer, so the strongest defenses harden accounts, applications, and federation rather than chasing malware signatures. Validate each of these with real testing rather than assuming it works.

Make authentication phishing-resistant

Deploy phishing-resistant MFA such as FIDO2 security keys or passkeys for every account, with no exceptions for legacy, test, or service accounts, the exact category APT29 exploited at Microsoft. Eliminate legacy authentication protocols that bypass MFA, and understand the MFA-bypass techniques the group actually uses so your controls close them.

Kill password spray and dormant accounts

Enforce strong password policies, disable or delete unused and legacy accounts, and apply conditional access that flags sign-ins from residential-proxy and anonymizing infrastructure. Alert on distributed low-volume failures across many accounts, the signature of a careful spray, not just high-volume brute force against one.

Govern OAuth apps and service principals

Inventory every OAuth application and service principal, review who consented to each, and remove high-risk permissions like EWS.full_access_as_app and EWS.AccessAsUser.All where they are not strictly needed. Enforce admin-consent policies so users cannot approve risky apps, and monitor for new application registrations, new credentials added to service principals, and unusual mailbox-access grants.

Protect federation and reduce dwell time

Treat AD FS token-signing certificates as crown-jewel secrets, monitor access to them, and watch for golden SAML indicators. Turn on comprehensive cloud audit logging, alert on anomalous sign-ins and app activity, and rehearse your incident response plan for a cloud identity compromise, since APT29's edge is the months it spends undetected. Block risky email attachments such as .rdp files and harden against DLL side-loading with application control and EDR.

Test your defenses like an adversary would

Assumptions about MFA coverage, app permissions, and detection are exactly what APT29 exploits. Regular penetration testing and red team exercises validate whether a sprayed test account, a consented app, or a forged token would actually be caught, before the SVR finds the gap first.

Why this matters for security teams

APT29 is the benchmark for stealthy, long-term intrusion. It does not need zero-days when a forgotten test account, an over-permissioned app, and a patient operator will do. The lesson from SolarWinds and from the Microsoft breach is the same: the weakest identity in your environment, not your best-defended server, is where a top-tier adversary gets in, and cloud espionage leaves far fewer traces than a malware infection.

For most organizations the takeaway is not that they will be personally targeted by the SVR, but that APT29's techniques, password spraying, OAuth abuse, token theft, and living off the land, are now standard across the threat landscape. Hardening identity against Cozy Bear hardens you against a large share of everything else.

FAQ

What is APT29?

APT29 is a Russian state-sponsored cyber espionage group operated by the SVR, Russia's Foreign Intelligence Service. Active since at least 2008 and tracked as MITRE ATT&CK group G0016, it specializes in stealthy, long-term intelligence collection against governments, diplomats, think tanks, and their technology providers.

Who is behind APT29?

APT29 is attributed by the US and UK governments to the SVR, the Russian Foreign Intelligence Service. It is a genuine intelligence service operation focused on espionage in support of Russian foreign policy, not a financially motivated criminal group, which shapes its patient, low-noise tradecraft.

What is APT29's MITRE ATT&CK ID?

APT29's MITRE ATT&CK group identifier is G0016. The catalog maps the group to techniques such as valid accounts (T1078), password spraying (T1110.003), application access token abuse (T1550.001), and golden SAML (T1606.002), which together describe its identity-centric approach.

What is the difference between APT28 and APT29?

Both are Russian, but APT28 (Fancy Bear) works for military intelligence, the GRU, and often pursues disruption and leaks, while APT29 (Cozy Bear) works for the SVR and focuses on quiet, long-term espionage. They have targeted the same victims, such as the DNC, with different objectives.

Is Cozy Bear the same as Midnight Blizzard?

Yes. Cozy Bear, Midnight Blizzard, Nobelium, and APT29 all name the same SVR group. Microsoft renamed the actor Midnight Blizzard in 2023, having previously called it Nobelium. Different vendors use different names for the same intrusion set, so all of them warrant the same response.

What is APT29 best known for?

APT29 is best known for the 2020 SolarWinds supply chain attack, in which it hid the SUNBURST backdoor in trusted Orion software updates to reach around 100 selected victims, including US federal agencies. More recently it breached Microsoft corporate email in 2023 to 2024 through cloud identity abuse.

Facing nation-state-grade identity attacks? DeepStrike's penetration testing and red team services stress-test your cloud, MFA, and OAuth defenses the way APT29 would. Explore our penetration testing services to find the gaps before an adversary does.