Russia's SVR foreign intelligence service. Executed the SolarWinds supply-chain compromise and remains the benchmark for patient, cloud-native espionage.
APT29 belongs to the SVR, Russia's civilian foreign intelligence service — the institutional successor to the KGB's First Chief Directorate. It is the most operationally disciplined state actor tracked in the public record.
The group's defining characteristic is patience. Where APT28 burns infrastructure and accepts noise, APT29 will spend a year inside a network without triggering a single alert. The SolarWinds operation is the clearest expression of this: the actor compromised the build system in September 2019, spent a month testing a benign code injection to verify it would go unnoticed, and only then shipped the SUNBURST backdoor to some 18,000 downstream customers — from which it selected fewer than 100 for actual follow-on exploitation.
Since 2021 APT29 has pivoted decisively toward identity and cloud. Rather than dropping malware on endpoints, it targets the authentication layer directly: stolen OAuth application consent, forged SAML assertions via the Golden SAML technique, service-principal abuse in Microsoft Entra ID, residential-proxy networks to defeat impossible-travel detection, and password spraying against legacy accounts without MFA. Its January 2024 breach of Microsoft's own corporate email began with a password spray against a legacy non-production test tenant.
Targeting is strategic and narrow: foreign ministries, national security policy bodies, IT and cloud providers used as stepping stones, and — during 2020 — COVID-19 vaccine research at institutions in the U.S., UK, and Canada.
Down to the named unit where public evidence supports it.
Formally attributed to the SVR by the U.S. and UK governments in April 2021, concurrent with sanctions on Russia over the SolarWinds compromise. The U.S. Treasury designation, NSA/CISA/FBI joint advisory, and UK NCSC statement were issued the same day and name the SVR explicitly. Unlike the GRU groups, no individual SVR officers have been indicted, and no internal unit designator has been publicly established.
Attributing sources
16 designators across 12 organisations.
3 designators are marked partial — the vendor's cluster overlaps this group but is not synonymous with it. Treating a partial correlation as an equivalence is the most common source of attribution error when pivoting between vendor reports.
Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
Weather-event family encodes the attributed origin; the adjective is arbitrary. Renamed from the older element taxonomy (STRONTIUM, NOBELIUM, HAFNIUM) in April 2023. 'Storm-####' is a temporary designator for a cluster still in development.
Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
Constellation denotes attributed origin or motive, adopted in 2023 to replace ad-hoc naming.
Colour prefix encodes attributed origin (RedXxxx = China, BlueXxxx = Russia). TAG-## ('Threat Activity Group') is a provisional designator for clusters pending attribution.
Names activity clusters descriptively rather than by a fixed nation-state taxonomy, and generally adopts the prevailing community name for established state actors. Coverage skews toward commodity and eCrime threats seen in managed-detection telemetry.
Descriptive names, frequently derived from the group's flagship malware family.
Descriptive names, often coined from a distinctive string or artifact in the toolset.
'Earth <name>' for many state-nexus groups; older clusters retain descriptive names such as Pawn Storm.
U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.
Target sectors
Target geography
Custom tooling is a strong clustering signal; shared and commodity tooling is not.
Custom / bespoke
Trojanised SolarWinds Orion plugin. Dormant for 12–14 days after install, verified the victim domain against a blocklist before activating.
Malpedia ↗Memory-only dropper deployed by SUNBURST to load a customised Cobalt Strike Beacon.
Malpedia ↗Second-stage loader used for lateral movement in a subset of SolarWinds victims.
Malpedia ↗Post-exploitation backdoor for AD FS servers that exfiltrates the token-signing certificate — enabling arbitrary token forgery.
Malpedia ↗Malicious AD FS DLL allowing authentication as any user by injecting a claim into the token issuance pipeline.
Modular backdoor delivered via wine-tasting-themed diplomatic lures across European foreign ministries.
Malpedia ↗HTML smuggling dropper delivering an ISO or IMG container to bypass Mark-of-the-Web.
Go-based C2 backdoor masquerading as a scheduled system task, with an encrypted decoy traffic generator.
Cross-platform Go/.NET implant used against COVID-19 vaccine research organisations.
Malpedia ↗Shared, commodity & living-off-the-land
Forging SAML assertions with a stolen token-signing key to authenticate to cloud services as any user, bypassing MFA entirely.
Commercial C2 framework with heavily customised malleable profiles and watermark-stripped beacons.
Legitimate Active Directory query tool used for domain reconnaissance.
Filtered on the date this actor was first reported exploiting the flaw — not the CVE's publication date.
| CVE | Product | Usage by APT29 | ||
|---|---|---|---|---|
| CVE-2023-42793KEVransomware | 9.8 | JetBrains TeamCityJetBrains | 1 Sep 2023 | Mass exploitation of internet-facing JetBrains TeamCity servers to reach software build pipelines — the same strategic objective as SolarWinds, pursued opportunistically at scale. Prompted a joint advisory from five countries.SRCCISA / FBI / NSA / NCSC-UK / SKW-PL ↗ |
| CVE-2021-21972KEVransomware | 9.8 | VMware vCenter ServerVMware | 1 Mar 2021 | VMware vCenter unauthenticated RCE listed among SVR-exploited vulnerabilities for initial access.SRCNSA / CISA / FBI ↗ |
| CVE-2020-1472KEVransomware | 10.0 | Windows NetlogonMicrosoft | 1 Oct 2020 | Zerologon used for domain escalation in intrusions following perimeter compromise.SRCCISA ↗ |
| CVE-2018-13379KEVransomware | 9.8 | FortiOS SSL VPNFortinet | 1 May 2020 | FortiOS SSL VPN path traversal used to obtain plaintext VPN credentials from unpatched appliances.SRCNSA / CISA / FBI ↗ |
| CVE-2019-11510KEVransomware | 10.0 | Pulse Connect SecureIvanti / Pulse Secure | 1 Apr 2020 | Pulse Secure file read used to harvest VPN credentials during the COVID-19 vaccine research targeting campaign.SRCNCSC-UK / CSE / NSA / CISA ↗ |
| CVE-2019-19781KEVransomware | 9.8 | Citrix ADC / GatewayCitrix | 1 Jan 2020 | Citrix ADC traversal exploited for initial access to enterprise perimeters.SRCNSA / CISA / FBI ↗ |
Actors sharing exploited CVEs
How this actor moves through an intrusion, stage by stage, titled by ATT&CK tactic. Read left to right.
3 techniques
Enters through the identity layer or the software supply chain rather than the endpoint. Historically that meant compromising a build system — SolarWinds Orion — and shipping the backdoor to 18,000 customers. Since 2021 it more often means a low-and-slow password spray against a forgotten legacy tenant, or a signed RDP configuration file that a diplomat opens without alarm.
1 technique
Persists as configuration, not as malware. Credentials added to an existing service principal, or a consented OAuth application with mailbox scope, survive endpoint reimaging and password rotation because nothing on disk was ever the foothold.
1 technique
Adds an attacker-controlled federated trust domain to the tenant. From that point the actor is not escalating within the environment so much as issuing itself whatever privilege it needs.
4 techniques
Optimises for never being investigated in the first place. SUNBURST slept twelve to fourteen days, checked the victim domain against a blocklist, and generated decoy traffic; operators cleared logs after each session and reused stolen code-signing certificates so payloads carried a valid signature.
3 techniques
Goes after the authority to mint credentials, not the credentials themselves. Stealing an AD FS token-signing certificate lets the actor forge SAML assertions for any user in the tenant — Golden SAML — which makes password resets and MFA enrolment irrelevant as a containment measure.
1 technique
Moves by authenticating, not by exploiting. A forged token or a stolen application access token is presented to the next service exactly as a legitimate user would present it, so lateral movement generates successful-login telemetry rather than intrusion telemetry.
1 technique
Takes mail, selectively. Mailbox collection is scoped to the specific officials whose correspondence answers the intelligence requirement — in the January 2024 Microsoft breach, the security and legal functions and the senior leadership team.
2 techniques
Blends with sanctioned SaaS. C2 rides Trello, Dropbox, Google Drive and Notion, egressing to domains the victim already allows, and residential proxies place the source IP in the victim's own country to defeat impossible-travel rules.
Scroll horizontally · characteristic chain across documented operations, not a single incident
Grouped in kill-chain order.
SolarWinds Orion build system compromise
Primary access vector since 2021
Signed RDP configuration files and device-code phishing
Adding credentials to existing service principals
Adding attacker-controlled federated trust domains
Low-and-slow spraying from residential proxies against legacy accounts lacking MFA
Golden SAML using stolen AD FS token-signing certificates
MagicWeb and FoggyWeb on AD FS
OAuth application consent abuse for persistent mailbox access
Residential proxy networks to match victim geolocation
Trello, Dropbox, Google Drive, and Notion abused as C2
Password spray against a legacy non-production test tenant without MFA, escalated via an OAuth application with elevated access to Microsoft corporate mailboxes — including members of the senior leadership team and the security and legal functions. Source code repositories were also accessed.
Targeting of vaccine development organisations using WellMess and WellMail implants and exploitation of unpatched VPN appliances, disclosed in a joint advisory from the UK, U.S., and Canada during the height of the pandemic.
Compromise of the SolarWinds Orion build system, distributing the SUNBURST backdoor to roughly 18,000 customers, from which fewer than 100 were selected for follow-on exploitation. Victims included the U.S. Departments of Treasury, Commerce, Homeland Security, State, Energy, and Justice. The actor spent a month testing a benign code injection before shipping the real payload.
Relationship type and confidence stated explicitly — 'related' without qualification is not an assessment.
Simultaneous, apparently uncoordinated presence in the DNC network in 2016 — a well-documented instance of Russian services not deconflicting.
Both conduct strategic espionage for Russian services; SVR and FSB respectively, with occasional target overlap in diplomatic networks.
Overlapping interest in policy, NGO, and think-tank targets, though Star Blizzard is FSB and far less capable.
Curated links to the reports that established what is known about this group.