APT29
A Russian cyber espionage group that NCSC-UK assesses is almost certainly part of the SVR, Russia's foreign intelligence service. It goes after cloud accounts, tokens and unpatched servers to collect intelligence, and Microsoft reported linked activity as recently as September 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The UK government has named this group several times. In July 2020 the NCSC and Canada's CSE assessed that APT29 targeted organisations involved in COVID-19 vaccine development in Canada, the US and the UK.7 In April 2021 the UK said it was highly likely that Russia's foreign intelligence service was responsible for the SolarWinds Orion compromise, while judging the overall impact on the UK to be low.8 In February 2024 the NCSC assessed the group is almost certainly part of the SVR.2
Its targets have widened beyond government, think tanks, healthcare and energy. The February 2024 advisory added aviation, education, law enforcement, local and state councils, government financial departments and military organisations.3 Software developers are also a concern: in the TeamCity campaign, agencies judged victims were chosen opportunistically, but warned about the supply chain access such a compromise could provide.9
UK targets have been directly in scope. Microsoft said its October 2024 phishing campaign reached thousands of targets across more than 100 organisations, particularly in the UK, Europe, Australia and Japan.5 Microsoft's 2026 reporting describes hotel and conference Wi-Fi being used to reach travelling staff, in several countries, without naming UK victims.4
Few of these methods depend on rare technical skill. Forgotten service accounts, long-lived tokens and loose device enrolment look like the practical places to start, whichever group is behind an attempt.
How It Attacks
This combines the February 2024 joint advisory with Microsoft's reporting.3,5,4 It is not a single fixed script, and each campaign uses only some of these steps. TeamCity and Zimbra details come from the 2023 and 2024 advisories.9,6
- 1
Reach Cloud Accounts
Password sprays and brute forces service accounts, and uses dormant accounts of former staff. After a reset, it may return through inactive accounts that were missed.
- 2
Steal Tokens or Fatigue MFA
Uses stolen access tokens to log in without a password, and sends repeated MFA requests until someone approves one.
- 3
Phish Selected People
Sends targeted emails from addresses at legitimate organisations, such as signed RDP files in the October 2024 campaign. Since February 2026, Microsoft has also reported device code and OAuth code phishing.
- 4
Exploit Known Flaws
Takes advantage of unpatched internet-facing systems such as TeamCity and Zimbra servers, and picks victims partly by who remains exposed.
- 5
Enrol Its Own Device
Registers a device it controls on the cloud tenant to keep access. Uses residential proxies so that its traffic looks like normal home connections.
- 6
Collect Intelligence
Collects Microsoft 365 data and, in the 2026 campaign, browser cookies, passwords and sign-in tokens.
Key Techniques
Selected from the group's ATT&CK v20 entry.1 ATT&CK lists many more, and a technique can sit under more than one tactic.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1110.003 | Password Spraying | Credential Access | Runs password sprays against accounts, including service accounts. |
| T1078.003 | Local Accounts | Initial Access | Targets dormant accounts of people who have left but whose access remains. |
| T1528 | Steal Application Access Token | Credential Access | Uses stolen tokens to access accounts without a password. |
| T1621 | Multi-Factor Authentication Request Generation | Credential Access | Sends repeated MFA requests to gain access to accounts. |
| T1098.005 | Device Registration | Persistence | Enrols its own devices into compromised cloud tenants. |
| T1078.004 | Cloud Accounts | Initial Access | Has gained a global administrator account in Azure AD. |
| T1059.009 | Cloud API | Execution | Uses the Microsoft Graph API to act across Azure and Microsoft 365. |
| T1566.001 | Spearphishing Attachment | Initial Access | Delivers malicious attachments to selected targets. |
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits flaws in VPN, Citrix and Zimbra systems. |
| T1090.002 | External Proxy | Command and Control | Uses compromised residential endpoints as proxies. |
Tools Observed
Malware Named by Governments and Microsoft
Malware Listed by ATT&CK
Dual-Use and Offensive Tools
These come from the NCSC, the joint TeamCity advisory, Microsoft and ATT&CK.7,9,4,1 Microsoft ties CornFlake and ChocoShell to Storm-2945, which it assesses is a sub-cluster of Midnight Blizzard. Some dual-use tools have legitimate uses, so a match alone does not prove compromise.
Vulnerabilities
These CVEs are tied to the group by government advisories or ATT&CK. They are not a complete list: The Stack reports that the October 2024 advisory described more than 20 exploited flaws.6
Patching closes only one route. Most of the 2024 cloud advisory concerns accounts, tokens and devices.3
Key Events
Operating from at least this year, according to ATT&CK.1
The NCSC and CSE report targeting of COVID-19 vaccine development. Foreign Secretary Dominic Raab condemns it.7,11
The UK says the SVR was highly likely responsible for the SolarWinds compromise.8
SVR actors exploit TeamCity from late September. A joint advisory including the NCSC follows in December.9
NCSC and partners warn about SVR tactics for gaining initial cloud access.2
The NCSC and US agencies publish an update on SVR exploitation of vulnerabilities.6,12 Microsoft reports a large phishing campaign using RDP files.5
Microsoft reports device code phishing from February and captive portal abuse from May, attributing it to Storm-2945. It saw the campaign resume on 29 September.4
Warning Signs
Drawn from the 2024 joint advisory and Microsoft's guidance.3,5,4 None of these proves an attack alone, but each deserves a quick check.
- Any use of a canary service account that should never log in
- Logins from dormant accounts or from people who have left
- A new device enrolled in your cloud tenant, particularly soon after a suspicious login
- Repeated MFA prompts for one account
- User agent changes during a session, or logins through residential address ranges
- Unexpected RDP files arriving by email, or outbound RDP to external networks
- Update or verification prompts shown on hotel or conference Wi-Fi
- Unexpected device code sign-ins
Defences That Matter
Clean Up Forgotten Accounts
- Review and disable dormant accounts regularly.3
- Apply least privilege to system and service accounts, and create canary service accounts that alert on any use.3
- Keep session lifetimes as short as practical.3
Lock Down Authentication
- Use phishing-resistant MFA, and limit where MFA and passkeys can be registered.4
- Restrict device enrolment to authorised devices and block re-enrolment of old ones.3
- Block device code flow where possible, and scope it with Conditional Access where needed.4
Reduce the Phishing Routes
- Restrict outbound RDP to external networks.5
- Treat hotel, conference and airport Wi-Fi as untrusted, and verify updates through the operating system.4
- Run attack simulations and teach staff how to report suspicious emails.5
Patch and Watch
- Prioritise patches for internet-facing systems, as the NCSC urged in October 2024.6
- Collect diverse logs and favour lower-noise signals, such as user agent changes, over blocking IP addresses.3
Could Someone Log In With an Account You Forgot?
We can review your cloud identities and exposed systems against the methods in this profile, then help you close the gaps.
Sources
- MITRE ATT&CK: APT29 (G0016), ATT&CK v20
- NCSC-UK and partners: SVR cyber actors adapt tactics for initial cloud access, 26 February 2024
- CISA copy of joint advisory AA24-057A: SVR Cyber Actors Adapt Tactics for Initial Cloud Access, February 2024
- Microsoft Threat Intelligence: CaptiveCrunch: Midnight Blizzard targets travelers worldwide, 31 July 2026, updated 5 October 2026
- Microsoft Threat Intelligence: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files, 29 October 2024
- The Stack: Patch! NCSC issues Russia red alert, 11 October 2024, updated 14 October 2024
- NCSC: Advisory: APT29 targets COVID-19 vaccine development, 16 July 2020
- GOV.UK: Russia: UK exposes Russian involvement in SolarWinds cyber compromise, 15 April 2021
- FBI, CISA, NSA, SKW, CERT Polska and NCSC-UK: advisory AA23-347A, Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally, December 2023
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- GOV.UK: UK condemns Russian Intelligence Services over vaccine cyber attacks, 16 July 2020
- American Hospital Association: Joint advisory on the update on SVR cyber operations and vulnerability exploitation, 11 October 2024
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.