Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-02

APT29

Also known as:UNC2452Cozy BearMidnight BlizzardSVRATK7Blue KitsuneBlueBravoCloaked UrsaCozyDukeDark HaloG0016Grizzly Steppe

As of 2026-09-27, APT29 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 8 threats spanning apt, phishing, cloud. Also known as UNC2452, Cozy Bear, Midnight Blizzard, SVR. ATT&CK coverage spans 107 techniques across 15 tactics in 8 of 8 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1071 (Application Layer Protocol), T1528 (Steal Application Access Token).

Tracked threats
82 critical · 6 high
First seen
2026-02-03
Last seen
2026-09-11
ATT&CK techniques
107across 8 of 8 threats
Related CVEs
8Referenced by its activity
Attribution
RussiaNation or origin
Nation: Russia · 8 tracked threat(s) · Categories: APT, PHISHING, CLOUD, ZERO_DAY, VULNERABILITY

Activity timeline

APT29 appears in 8 tracked threats between and ; the busiest month was 2026-02 with 2 reports.

ATT&CK techniques observed

107 techniques observed across 8 of 8 tracked threats · Stealth (formerly Defense Evasion) (19), Credential Access (12), Persistence (12), Execution (10), Collection (9), Discovery (7)
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 6 of 8 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 5 of 8 tracked threats
  • T1528 Steal Application Access Token — Credential Accessobserved in 5 of 8 tracked threats
  • T1566 Phishing — Initial Accessobserved in 5 of 8 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 4 of 8 tracked threats
  • T1087 Account Discovery — Discoveryobserved in 4 of 8 tracked threats
  • T1114 Email Collection — Collectionobserved in 4 of 8 tracked threats
  • T1204 User Execution — Executionobserved in 4 of 8 tracked threats
  • T1550 Use Alternate Authentication Material — Lateral Movementobserved in 4 of 8 tracked threats
  • T1583 Acquire Infrastructure — Resource Developmentobserved in 4 of 8 tracked threats
  • T1588 Obtain Capabilities — Resource Developmentobserved in 4 of 8 tracked threats
  • T1005 Data from Local System — Collectionobserved in 3 of 8 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 3 of 8 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 3 of 8 tracked threats
  • T1071.001 Web Protocols — Command and Controlobserved in 3 of 8 tracked threats

Tracked threats

Related CVEs

8 CVEs referenced by tracked APT29 activity