APT 29 Cozy Bear Attribution and Major Operations

APT29’s major operations, from SolarWinds to Microsoft’s corporate email breach, follow one rule. Russia’s Foreign Intelligence Service values patient intelligence collection over disruption. Understanding that mandate explains more about Cozy Bear than an alias list ever will, and gives defenders a practical way to recognize the same threat as it moves from software updates to cloud identities and live camera feeds.

Who APT29 is and what the SVR mandate means for how it operates

APT29 is an intelligence collection operation run by Russia’s Foreign Intelligence Service, or SVR. Its job is to gather information without announcing its presence. The US government and the UK NCSC, together with the NSA, CISA, and FBI, have formally attributed the group to that service. SVR sponsorship is therefore not background color. It explains why access that stays useful is worth more to this actor than an attack that makes headlines.

That priority distinguishes APT29 from its GRU-linked counterpart, APT28. GRU operations lean toward disruption, leaks, and influence, while SVR operations favor remaining undetected and collecting intelligence. MITRE ATT&CK tracks APT29 as G0016 and dates its activity to at least 2008. This is institutional learning. Its evolving techniques reflect years spent refining how to enter, remain, and collect without giving defenders a reason to look closer.

How the doctrine translates into a consistent operational playbook across evolving attack surfaces

The February 2024 joint advisory from UK NCSC, NSA, CISA, FBI, CNMF, and international partners describes cloud intrusion methods that fit that mandate. Password spraying targets service and dormant accounts without MFA, while token theft and MFA bombing offer routes around multifactor prompts. Residential proxies make traffic appear to come from normal users. Each method seeks access that can blend into the environment.

Once inside, APT29 abuses OAuth applications and service principals to establish durable, token-based mailbox access. That access can survive a password reset. Command and control through legitimate platforms, including Microsoft 365, Dropbox, and Google Drive, serves the same purpose by disguising traffic as ordinary HTTPS activity.

Early 2024 attacks used wine-tasting invitations against European diplomats and German political parties to deliver WINELOADER, a modular backdoor, through DLL side-loading. GRAPELOADER appeared in 2025 diplomatic campaigns as an initial-stage delivery chain leading to WINELOADER. The invitation was much less pleasant than advertised. A separate rogue RDP campaign beginning October 22, 2024, used signed Remote Desktop Protocol files to connect victims’ devices to actor-controlled servers, reaching government, higher education, defense, and nonprofit targets across dozens of countries.

These techniques differ, but their operational purpose does not. Low-volume credential abuse, trusted-platform hijacking, and careful cleanup support selective collection with a minimal footprint. As organizations moved from on-premises infrastructure to cloud identity, APT29 moved with them. The attack surface changed more than the doctrine did.

SolarWinds as the clearest proof of the doctrine at scale

APT29 inserted the SUNBURST backdoor into trojanized updates for the Orion network monitoring platform. The updates were digitally signed and came through a trusted vendor relationship. That trust did the heavy lifting. Rather than establish credibility separately with each victim, the attackers inherited it through software customers already expected to install.

The broad distribution did not lead to indiscriminate follow-on exploitation. APT29 selected high-value targets, including US federal agencies, for further intrusion and collection. The group combined a widely distributed access mechanism with a narrow intelligence appetite. The group intended its long dwell time before detection to give it enough time inside to gather information that would have lasting strategic value.

FireEye disclosed the operation through its Mandiant incident response division in December 2020. The US government and UK NCSC formally attributed it to the SVR in April 2021. Attribution rested on converging evidence rather than one distinctive artifact, including malware analysis, command-and-control infrastructure mapping, code overlaps, and victimology. That distinction becomes important as tooling changes. SolarWinds established both the strategic value of inherited trust and the forensic framework that later campaigns would put under pressure.

The Microsoft and HPE breaches as a tactical evolution from software supply chains to identity infrastructure

Microsoft disclosed in January 2024 that Midnight Blizzard, its name for APT29, had accessed corporate email beginning in late November 2023. The attackers first got in through a password spray against a legacy non-production test tenant account without MFA. The attackers then compromised a legacy OAuth application and created actor-controlled OAuth applications with the Exchange Online full_access_as_app role. Those permissions opened senior leadership and cybersecurity team mailboxes.

The objective included learning what Microsoft knew about the attackers. This was intelligence collection about the defenders themselves. By March 2024, Microsoft reported that stolen corporate email was being used to gain, or attempt to gain, access to source code repositories and internal systems. CISA’s emergency directive told US federal agencies to deal with the risks that followed. The agency said SVR operatives had used authentication details exchanged by email between Microsoft and customers to access certain customer systems.

The link to SolarWinds is the reuse of a provider’s trusted position to reach beyond that provider. Here, identity infrastructure and information held in email supplied the leverage that software updates had supplied before. The vendor was again more than a single target. Its relationships widened the consequences of the breach.

HPE disclosed mailbox access and exfiltration beginning in May 2023, approximately seven months before it was notified on December 12, 2023. Its January 24, 2024, 8-K filing, reporting a January 19 event date, followed Microsoft’s January 19 filing and marked the first time the SEC’s new cybersecurity disclosure rule materially shaped the public record of a confirmed APT campaign. The disclosure mechanism was new. The patience was familiar. Together, the breaches showed that the group kept seeking out providers whose inside knowledge and ties to customers could help it gather more intelligence.

GTG-20006 and what the active 2025–2026 cluster adds to the picture

Anthropic’s disclosure describes the internally labeled GTG-20006 cluster as applying the same access-and-collect approach to European and Ukrainian government, military, defense, and diplomatic targets. UltraViolet Cyber’s threat advisory places the activity from roughly December 2025 through August 2026. Its target set includes ministries, intelligence bodies, embassies, think tanks, and companies connected to military drone supply chains. The doctrine is operating in a wartime setting. Microsoft also assesses the related Storm-2945 cluster as an operational sub-cluster of Midnight Blizzard.

The camera-streaming activity adds a distinct capability to that picture. Weaknesses in how platform interfaces handled authorization allowed user-account enumeration and let the attackers get tokens that gave them access to live video feeds. This is not simply another collection of stolen documents. Live feeds can give attackers operational intelligence for use in active conflict. The campaign also reached hospitality companies through hotel guest Wi-Fi providers and targeted drone manufacturers and their supply chains, gathering information from the businesses around its primary targets.

The access methods remain recognizable despite that expanded reach. They include spear-phishing, device code and OAuth token theft, password spraying against cloud identity providers, and compromise of trusted third parties. Native cloud administration tools support living-off-the-land activity after entry. AI-assisted malware retooling adds a faster iteration cycle. The new capabilities broaden what APT29 can collect and how quickly it can adapt, without replacing the underlying preference for quiet, durable access.

Why attribution is becoming harder as APT29 adopts AI-assisted operations

AI-assisted infrastructure setup, code maintenance, and malware retooling complicate the forensic framework used after SolarWinds. UltraViolet Cyber’s advisory describes iterative malware changes intended to evade detection once security products identify the code. A signature can consequently lose usefulness sooner. The attacker is still pursuing the same mission, but the artifacts available to connect one intrusion to another can change faster.

Shared tooling already makes attribution less tidy than an alias chart suggests. APT29 and the state-sponsored group Kimsuky both use PsExec, though they work for different states. A tool name is not a passport. AI-assisted emulation of other actors’ techniques can deepen that convergence, making familiar code and technique combinations less distinctive. Practitioners have a harder time telling whether similar attacks come from the same operators or from different operators using the same methods.

That does not make the doctrinal framework obsolete. APT29’s preference for patience, deniability, and low-and-slow credential abuse has remained stable across its long operational history. AI accelerates optimization. Doctrine can therefore help interpret activity, but it cannot establish attribution on its own. As static signatures and technique matching become less reliable, behavioral detection must take greater weight without turning a recognizable pattern into proof of identity.

What the doctrinal through-line means for how defenders should prioritize

Defenders should prioritize the neglected access paths APT29 repeatedly chooses. Microsoft’s legacy test account illustrates why phishing-resistant MFA enforcement belongs near the front of that response. An account’s “non-production” label did not prevent it from becoming an entry point. Dormant and service accounts deserve attention for the same documented reason.

OAuth persistence makes unnecessary device-code and OAuth flows another priority for removal. Password resets alone do not address the token-based mailbox access described earlier. Segmentation of identity and VPN infrastructure can limit the reach of a credential compromise, while audits of third-party and IoT integrations address the trusted-provider and camera-streaming paths. The advisory also recommends VPN enforcement for staff traveling internationally. That advice responds to the campaign’s reach into hospitality through hotel guest Wi-Fi providers and goes beyond general travel advice.

As malware signatures become outdated faster, defenders should focus on account behavior, OAuth permission grants, and cloud API usage patterns. These are the activities through which access is established, expanded, and retained. Security vendors also face a particular exposure because APT29 targets cybersecurity staff and leadership to learn what defenders know. Their threat research and internal analysis are intelligence assets in their own right.

Why security vendors writing about APT29 face the same credibility test the group exploits in its targets

People who track APT29 can tell technical analysis from an alias list wearing a serious expression. They need the connection between an access path, its evidence, and the intelligence objective it serves. A description of the Microsoft breach that stops at “password spraying” misses the OAuth persistence and subsequent use of stolen email. A SolarWinds account that stops at “supply chain attack” misses the selective exploitation and attribution evidence.

For security vendors, that makes publishing about this actor a credibility test. The audience assessing the analysis is also an audience APT29 treats as a valuable intelligence target. Technical authenticity has a concrete standard here. Content must distinguish attribution from resemblance, explain what changed between campaigns, and connect defensive recommendations to documented access paths. Generic cloud-security advice does not meet that standard merely because Cozy Bear appears in the headline.

Specialist cybersecurity content studios such as Cyberou offer one option for this work, grounding material in live threat intelligence to help practitioners connect tactical changes to underlying doctrine. The value lies in research-backed explanation. For an APT29 article, the test is whether readers can explain why a signed update, an OAuth application, and a camera-streaming token belong in the same argument. Each turns a trusted relationship into an intelligence opportunity, which is precisely the relationship defenders need to examine.