# APT29

> As of 2026-10-17, APT29 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 9 threats spanning apt, phishing, cloud. Also known as Midnight Blizzard, UNC2452, Cozy Bear, SVR. ATT&CK coverage spans 114 techniques across 15 tactics in 9 of 9 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1071 (Application Layer Protocol), T1528 (Steal Application Access Token).

- **Nation:** Russia
- **Tracked threats:** 9
- **Categories:** APT, PHISHING, CLOUD, ZERO_DAY, VULNERABILITY
- **Also known as:** Midnight Blizzard, UNC2452, Cozy Bear, SVR, ATK7, Blue Kitsune, BlueBravo, Cloaked Ursa, CozyDuke, Dark Halo, G0016, Grizzly Steppe
- **As of:** 2026-10-17

## ATT&CK techniques observed

114 techniques observed across 9 of 9 tracked threats. Tactics: Stealth (formerly Defense Evasion) (24), Credential Access (12), Persistence (12), Execution (11), Collection (9), Discovery (7).

- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 7 of 9 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 5 of 9 tracked threats
- [T1528](https://intel.threadlinqs.com/technique/T1528) Steal Application Access Token — Credential Access — observed in 5 of 9 tracked threats
- [T1566](https://intel.threadlinqs.com/technique/T1566) Phishing — Initial Access — observed in 5 of 9 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 4 of 9 tracked threats
- [T1087](https://intel.threadlinqs.com/technique/T1087) Account Discovery — Discovery — observed in 4 of 9 tracked threats
- [T1114](https://intel.threadlinqs.com/technique/T1114) Email Collection — Collection — observed in 4 of 9 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 4 of 9 tracked threats
- [T1550](https://intel.threadlinqs.com/technique/T1550) Use Alternate Authentication Material — Lateral Movement — observed in 4 of 9 tracked threats
- [T1583](https://intel.threadlinqs.com/technique/T1583) Acquire Infrastructure — Resource Development — observed in 4 of 9 tracked threats
- [T1588](https://intel.threadlinqs.com/technique/T1588) Obtain Capabilities — Resource Development — observed in 4 of 9 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 3 of 9 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 3 of 9 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 3 of 9 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 3 of 9 tracked threats

## Tracked threats

- [EasterBunny: advanced modular espionage implant attributed to APT29 (SVR)](https://intel.threadlinqs.com/threat/TL-2026-3839) — HIGH
- [Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets](https://intel.threadlinqs.com/threat/TL-2026-2446) — HIGH
- [Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and captive portal compromise targeting academia, defense, and government across Europe and the US](https://intel.threadlinqs.com/threat/TL-2026-2091) — HIGH
- [Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)](https://intel.threadlinqs.com/threat/TL-2026-0824) — HIGH
- [ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit (Unit 42)](https://intel.threadlinqs.com/threat/TL-2026-0561) — HIGH
- [Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365](https://intel.threadlinqs.com/threat/TL-2026-0323) — HIGH
- [Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513)](https://intel.threadlinqs.com/threat/TL-2026-0175) — CRITICAL
- [Screensaver (.SCR) Files Used as Initial Access Vector](https://intel.threadlinqs.com/threat/TL-2026-0104) — HIGH
- [CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against Ukraine](https://intel.threadlinqs.com/threat/TL-2026-0041) — CRITICAL

## Related CVEs

8 CVEs referenced by tracked APT29 activity.

- [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513)
- [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509)
- [CVE-2023-36884](https://intel.threadlinqs.com/cve/CVE-2023-36884)
- [CVE-2023-23397](https://intel.threadlinqs.com/cve/CVE-2023-23397)
- [CVE-2022-30190](https://intel.threadlinqs.com/cve/CVE-2022-30190)
- [CVE-2021-40444](https://intel.threadlinqs.com/cve/CVE-2021-40444)
- [CVE-2017-11882](https://intel.threadlinqs.com/cve/CVE-2017-11882)
- [CVE-2017-0199](https://intel.threadlinqs.com/cve/CVE-2017-0199)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/APT29