APT29
Russian state-sponsored (SVR) · Espionage / intelligence collection / supply chain access
Tactics, Techniques & Procedures (TTPs)
- Supply chain compromise (SolarWinds Orion, IT service providers)
- OAuth application abuse for persistent cloud tenant access
- Residential proxy networks for detection evasion
- WINELOADER and ROOTSAW staged downloaders
- Dormant account reactivation in cloud directories
- Cloud management plane lateral movement
- CaptiveCrunch: manipulation of DNS/HTTP traffic in hotel and conference-venue Wi-Fi captive portal infrastructure to redirect connecting users to actor-controlled systems
- Fake Microsoft 365 login pages and device code phishing flows to register attacker-controlled devices with Entra ID (device code phishing observed since February 2026)
- ClickFix-style fake browser/OS update prompts to deliver malware; malicious Android APK payloads to mobile devices on affected networks
- CornFlake — a Go-based Windows RAT persisting as a fake 'Cloud Sync Service', with keylogging, clipboard/screenshot/audio-video capture, and M365/Azure AD token theft
- ChocoShell — an in-memory, fileless PowerShell infostealer extracting browser session cookies, saved passwords, M365 SSO tokens, and stored Wi-Fi credentials
- FruitStone ('CloudSync Console') — a web-based C2 panel found by Microsoft to have no authentication on any function
Known Targets
Analyst Notes
SVR Foreign Intelligence Service. The SolarWinds Orion supply chain compromise (2020) affected approximately 18,000 organisations and provided access to multiple US federal agencies. Compromised Microsoft senior leadership email in January 2024 while actively searching for information about APT29 detection capabilities — a sophisticated counter-intelligence operation. Additional reporting: Disclosed by Microsoft on 31 July 2026. Reflects a tactical shift toward harvesting cloud credentials via trusted hospitality/travel infrastructure rather than direct targeting of organisational networks.
Also Known As
MITRE ATT&CK Techniques
Intelligence Reports
CaptiveCrunch: Midnight Blizzard Targets Corporate Travellers via Hotel Wi-Fi
Russian threat actor Storm-2945, linked to Midnight Blizzard, has been compromising hotel and conference Wi-Fi captive portals since May 2026 to harvest Microsoft 365 credentials from corporate travellers using custom malware families CornFlake and ChocoShell.
Midnight Blizzard: A Complete Profile of Russia's SVR Espionage Apparatus
APT29 — Cozy Bear, Midnight Blizzard — is Russia's SVR-aligned intelligence collection machine, responsible for SolarWinds, the 2024 Microsoft corporate email compromise, and ongoing targeting of European governments, diplomatic missions, and defence industrial base organisations. This deep dive covers their full operational history, tradecraft, tooling, and what defenders need to be doing now.
APT29 Exploiting Trusted Vendor Relationships to Reach UK and European Government Networks
Russia's SVR-linked APT29 is using compromised software vendor and IT service provider accounts to pivot into government targets -- a continuation of the SolarWinds playbook applied to UK and European supply chains.