APT29 Explained: How the SVR Targets UK Organisations
Cybergen InsightsCREST-certified security team
|
|
12 min read
Most cyber attacks you read about are loud. Ransomware locks systems, criminals publish stolen data and everyone knows within hours. APT29 is the opposite. It is one of the most capable espionage groups in the world, and its whole method is built around not being noticed: logging in rather than breaking in, using your own cloud services against you and staying for months.
The UK government has named it publicly several times, for targeting COVID-19 vaccine research, for the SolarWinds compromise and for adapting its tactics to break into cloud services. This guide explains who APT29 is, how a modern campaign unfolds step by step, which organisations it targets and the defences that actually make a difference. For the full sourced profile, including techniques, tools and indicators, see our APT29 threat actor profile in Threat Watch.
Who Is APT29?
APT29 is a Russian state-sponsored cyber espionage group. In February 2024 the NCSC assessed that it is almost certainly part of the SVR, Russia's Foreign Intelligence Service, an assessment shared by its US, Australian, Canadian and New Zealand partners. MITRE ATT&CK records it as active since at least 2008.
You will see it under many names, because each security company tracks it separately. Microsoft calls it Midnight Blizzard. Others use Cozy Bear, The Dukes, NOBELIUM, UNC2452 and YTTRIUM. The names differ, but government advisories treat them as the same SVR-linked activity.
What sets APT29 apart is its purpose. It is not trying to make money or cause disruption. It is collecting intelligence for the Russian state: policy, diplomatic, defence, research and technology information. That shapes everything about how it operates. Speed matters less than staying hidden, and a single well placed mailbox can be worth more than a thousand encrypted servers.
APT29 is not Fancy Bear
It is easy to confuse the Russian groups. Fancy Bear, also called APT28, belongs to the GRU, Russia's military intelligence service, and has a history of disruptive and influence operations. APT29 belongs to the SVR and focuses on quiet, long term espionage. Both matter, but they need different defensive priorities.
How APT29 Has Targeted the UK
The UK has been directly in the firing line. Here are the moments where the British government and its partners have called the group out publicly.
- Vaccine research, July 2020. The NCSC and Canada's CSE reported that APT29 targeted organisations developing COVID-19 vaccines in the UK, US and Canada.
- SolarWinds, April 2021. The UK government said it was highly likely the SVR was responsible for compromising the SolarWinds Orion software, which gave access to thousands of organisations through a trusted update.
- TeamCity, December 2023. A joint advisory co-authored by the NCSC described SVR exploitation of a flaw in JetBrains TeamCity, a tool used by software developers. Agencies warned about the supply chain access such compromises can give.
- Cloud access, February 2024. The NCSC and partners warned that the SVR had adapted its tactics to gain initial access to cloud environments, through service accounts, dormant accounts and stolen tokens.
- Mass phishing, October 2024. Microsoft reported a spear-phishing campaign using malicious RDP files that reached thousands of targets in more than 100 organisations, particularly in the UK, Europe, Australia and Japan.
The targets have widened over time. The 2024 advisory listed aviation, education, law enforcement, local and state councils, government financial departments and military organisations alongside the group's traditional focus on government, think tanks, healthcare and energy.
A Campaign, Step by Step
The best way to understand APT29 is to follow a real operation. In July 2026, Microsoft described a campaign it calls CaptiveCrunch, run by a sub-cluster it tracks as Storm-2945 and assesses is part of Midnight Blizzard. It went after business travellers through hotel and conference Wi-Fi, and Microsoft saw it resume on 29 September 2026. Select any step, or let it play through.
How one 2026 operation unfolds, step by step
What stops it:
Look at what is missing from that story. There is no exotic zero-day and no ransomware. Every step relies on a user doing something that looks reasonable, or on a legitimate feature being used in an unexpected way. That is why APT29 is so hard to stop with traditional antivirus and so vulnerable to good identity controls.
The Techniques That Matter Most
APT29 has a large toolkit, but a handful of techniques appear again and again in UK and allied advisories. The table below maps the most common to what you might see and the defence that works best.
| Technique | What it looks like | Best defence |
|---|---|---|
| Password spraying ATT&CK T1110.003 | A few common passwords tried against many accounts, including service accounts | MFA on every account, and alerts on sign-in failures spread across many users |
| Dormant account abuse ATT&CK T1078.003 | Logins to accounts of people who have left but whose access remains | Regular reviews that disable leavers and unused accounts |
| Token theft ATT&CK T1528 | Access without a password, using a stolen session or refresh token | Short token lifetimes, token protection and risk based Conditional Access |
| MFA fatigue ATT&CK T1621 | Repeated MFA prompts until a tired user approves one | Phishing-resistant MFA such as passkeys, and number matching |
| Device registration ATT&CK T1098.005 | The attacker enrols its own device into your cloud tenant | Allow only authorised devices to enrol and block re-enrolment |
| Exploiting public servers ATT&CK T1190 | Known flaws in internet-facing software, such as TeamCity in 2023 | Patch by known exploitation, using the CISA KEV catalogue |
Notice the pattern. Five of the six are about identity: accounts, passwords, tokens and devices. The NCSC's 2024 advisory made the point directly: as organisations modernise and move to the cloud, the SVR has adapted with them, and the way in is increasingly an account rather than an unpatched server. That does not mean patching no longer matters. Public facing software is still exploited, which is why prioritising flaws from the CISA Known Exploited Vulnerabilities catalogue is worth doing.
Who APT29 Is Most Likely to Target
You do not have to be a government department to be of interest. APT29 targets organisations that hold information the Russian state wants, and organisations that give access to others. Use this quick check to see how closely you match the pattern.
Are you the kind of organisation APT29 looks at?
Tick anything that applies.
Software and IT service companies deserve a special mention. SolarWinds and TeamCity both showed that compromising one supplier can open doors into many customers. If you build, host or manage technology for others, you may be a target because of who your customers are, not because of what you hold yourself.
What APT29 Wants
Understanding the motive helps you predict the method. APT29 collects intelligence that supports Russian foreign policy, so the information it looks for tends to fall into a few groups.
- Policy and diplomacy. Government positions, negotiations, sanctions thinking and the views of officials and advisers. Think tanks and consultancies that advise government are targeted for the same reason.
- Research and technology. The 2020 vaccine campaign showed a clear interest in scientific research. Universities, healthcare and technology firms hold work that has strategic or commercial value.
- Access to others. Software developers, IT service providers and cloud platforms can be a route into many customers at once. SolarWinds remains the clearest example.
- Insight into the defenders. Security teams, incident responders and technology companies hold information about how attacks are detected and investigated, which helps the group stay hidden.
Because the goal is to read rather than to destroy, the group usually concentrates on email, document stores and cloud identity. A compromised mailbox of a senior person can be enough. That is why the most useful question for a board is not "could we be encrypted?" but "who could be quietly reading our most sensitive conversations, and would we notice?"
Signs APT29 May Already Be Inside
Espionage intrusions are often discovered months after they began. These signals, drawn from the NCSC and partner advisories and Microsoft's reporting, are worth checking now. None proves an intrusion on its own, but each deserves a closer look.
- Successful sign-ins to accounts that belong to people who have left, or that have not been used for months
- Sign-in failures spread thinly across many accounts, which can indicate password spraying
- New devices registered to your cloud tenant that nobody can account for
- Applications granted access to mailboxes or files without a clear business reason
- Tokens used from unfamiliar locations or networks shortly after a legitimate sign-in
- Staff reporting update prompts or code requests while using hotel or conference Wi-Fi
- Unusual activity on service accounts, especially at times when nobody is working
If several of these appear together, treat it as an incident and bring in specialists. Do not alert the attacker by resetting everything at once before you understand the scope. A coordinated response that removes all of their access in one go is far more effective than a series of partial fixes, which an experienced group will simply work around. Our guide to the first 24 hours of a cyber attack covers how to contain without tipping your hand.
The Defences That Actually Work
Because APT29 relies on stealth, the goal is twofold: make the easy ways in hard, and make quiet activity noisy. Work through these in order.
Identity first
Where almost every recent campaign beginsThen visibility
So a quiet intruder becomes a noisy oneThen the edges
Servers, software and travelling staff1. Make identity the front line
Move to phishing-resistant MFA, such as passkeys or FIDO2 security keys, starting with administrators and staff who handle sensitive information. Block device code flow unless there is a clear business need, and restrict it with Conditional Access where there is. Disable dormant accounts regularly, because the 2024 advisory specifically warned about accounts of people who have left. Limit which devices can be enrolled into your tenant and block re-enrolment of old ones.
2. Shorten what a stolen token is worth
Stolen tokens let attackers skip passwords and MFA. Keep session lifetimes as short as practical, use token protection features where your platform supports them and apply sign-in risk policies that challenge unusual locations or devices. Create canary service accounts that should never be used, and alert the moment they are.
3. Watch identity logs around the clock
APT29's activity often looks like normal sign-ins. The signals that matter are subtle: a dormant account waking up, a new device registered at an odd hour, an application granted mailbox access. Someone needs to see those alerts quickly, at any time of day. That is what 24/7 managed detection and response is for.
4. Protect people on the move
Give travelling staff a mobile hotspot or a company travel router, and teach them never to install updates offered by a network login page. Microsoft's guidance after CaptiveCrunch also recommends not reusing corporate credentials on guest Wi-Fi registration pages and minimising details about your employer and travel when you sign up.
5. Use threat intelligence, not just headlines
APT29's tactics shift every year. Following government advisories and turning them into detections for your own environment is the difference between reading about a campaign and catching it. Our APT29 profile in Threat Watch keeps the techniques, tools, CVEs and warning signs in one place, and our cyber threat intelligence service turns that into priorities for your team.
How Cybergen Can Help
APT29 is patient, well resourced and focused on staying hidden. Defending against it is less about buying a single product and more about getting identity, monitoring and intelligence working together. We help with:
- Cyber threat intelligence that tracks APT29 and other state actors and turns reporting into detections
- Identity security and privileged access management to close the routes APT29 uses most
- 24/7 managed detection and response to spot quiet sign-in anomalies before they become a long term compromise
- Red and purple teaming that emulates APT29 techniques against your own controls
If you think you could be a target, talk to our team about a threat hunt or an identity review.
State actor tactics change quickly. This article reflects public reporting from the NCSC, US agencies and Microsoft as at 13 November 2026.
Frequently Asked Questions
What is APT29?
APT29 is a Russian state-sponsored cyber espionage group. The UK's NCSC assesses that it is almost certainly part of the SVR, Russia's Foreign Intelligence Service. It is also known as Midnight Blizzard, Cozy Bear, The Dukes and NOBELIUM, and has operated since at least 2008.
Is APT29 the same as Fancy Bear?
No. Fancy Bear, also called APT28, is linked to Russia's military intelligence service, the GRU. APT29 is linked to the SVR. Both are Russian state actors, but they have different masters, priorities and methods. APT29 is known for patient, low noise espionage.
Does APT29 target private companies or only governments?
Both. Government, diplomacy and policy bodies are core targets, but advisories also name healthcare, energy, technology, education, aviation and think tanks. Software and IT service companies matter because compromising them can give access to their customers.
What is device code phishing?
It abuses a legitimate sign-in method designed for devices without keyboards. The attacker starts a sign-in, then tricks the victim into entering a code on a genuine Microsoft page. The victim's approval signs the attacker in. Blocking or tightly restricting device code flow is the main defence.
How do we know if APT29 has been in our network?
Look for unusual sign-ins to dormant or service accounts, new devices registered to your tenant, unexpected app consents, long-lived tokens used from unfamiliar locations and access to mailboxes that do not fit normal patterns. A threat hunt by specialists, using published indicators, is the most reliable check.
Sources
- MITRE ATT&CK: APT29 (G0016)
- NCSC: SVR cyber actors adapt tactics for initial cloud access (26 February 2024)
- CISA: Joint advisory AA24-057A (February 2024)
- NCSC: APT29 targets COVID-19 vaccine development (16 July 2020)
- GOV.UK: UK exposes Russian involvement in SolarWinds cyber compromise (15 April 2021)
- CISA: Joint advisory AA23-347A on TeamCity exploitation (December 2023)
- The Stack: NCSC issues Russia red alert (October 2024)
- Microsoft: Midnight Blizzard spear-phishing campaign using RDP files (29 October 2024)
- Microsoft: CaptiveCrunch, Midnight Blizzard targets travellers worldwide (31 July 2026, updated 5 October 2026)
CREST-certified consultants with over 100 years of combined experience in threat intelligence, penetration testing, MDR and compliance.
