Messy Adventures of Cozy Bear

APT29 has bypassed UAC.[24]

APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.[12]

APT29 has used PowerShell to discover domain accounts by executing Get-ADUser and Get-ADGroupMember.[17][14]

APT29 has conducted enumeration of Azure AD accounts.[25]

APT29 has added credentials to OAuth Applications and Service Principals.[26][17]

APT29 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.[12][26][25]

APT29 has granted company administrator privileges to a newly created service principal.[17]

APT29 registered devices in order to enable mailbox syncing via the Set-CASMailbox command.[12]

APT29 has acquired C2 domains, sometimes through resellers.[10][27][18]

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.[28][18]

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.[13]

APT29 has used HTTP for C2 and data exfiltration.[12]

APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration; APT29 has also compressed text files into zipped archives.[12][29][17]

APT29 added Registry Run keys to establish persistence.[24]

APT29 has conducted brute force password spray attacks.[20][25]

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.[12][30][31][24][32][17][33][15]

APT29 used cmd.exe to execute commands on remote machines.[12][30]

APT29 has written malware variants in Visual Basic.[13]

APT29 has developed malware variants written in Python.[22]

APT29 has compromised email accounts to further enable phishing campaigns.[34]

APT29 has compromised domains to use for C2.[10]

APT29 can create new users through Azure AD.[25]

APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.[29]

APT29 has stolen user's saved passwords from Chrome.[17]

APT29 has accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.[17]

APT29 has downloaded source code from code repositories.[35]

APT29 has extracted files from compromised networks.[12]

APT29 has used steganography to hide C2 communications in images.[22]

APT29 staged data and files in password-protected archives on a victim's OWA server.[12]

APT29 used 7-Zip to decode its Raindrop malware.[36]

APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.[9][11][29]

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.[37][38]

APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.[39][14]

APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.[12] They also used AdFind to enumerate domains and to discover trust between federated domains.[29][17]

APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.[12]

APT29 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.[12][13]

APT29 has used multiple layers of encryption within malware to protect C2 communication.[15]

APT29 has used WMI event subscriptions for persistence.[24][22][39][29]

APT29 used sticky-keys to obtain unauthenticated, privileged console access.[24][40]

APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.[12]

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.[23][12][13]

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.[3][13][18]

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.[33]

APT29 has used compromised identities to access networks via SSH, VPNs, and other remote access tools.[10][23][17]

APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.[12]

APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.[12]

APT29 created tokens using compromised SAML signing certificates.[26][14]

APT29 has conducted credential theft operations to obtain credentials to be used for access to victim environments.[17]

APT29 used the service control manager on a remote system to disable services associated with security monitoring products.[29]

APT29 used AUDITPOL to prevent the collection of audit logs.[29]

APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.[29]

APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.[9]

APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.[9][24]

APT29 modified timestamps of backdoors to match legitimate Windows files.[29]

APT29 removed evidence of email export requests using Remove-MailboxExportRequest.[12]

APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access.[9]

APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.[9]

APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.[12]

APT29 renamed software and DLL's with legitimate names to appear benign.[12][30][16]

APT29 has edited the Microsoft.IdentityServer.Servicehost.exe.config file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.[41]

APT29 has used repeated MFA requests to gain access to victim accounts.[42]

APT29 has used TCP for C2 communications.[32]

APT29 has used encoded PowerShell commands.[32]

APT29 has used large file sizes to avoid detection.[16]

APT29 used UPX to pack files.[24]

APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.[33]

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.[24][3][32]

APT29 leveraged privileged accounts to replicate directory service data with domain controllers.[39][29][17]

APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.[12]

APT29 has used AdFind to enumerate domain groups.[17]

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.[3][32][22][18][33][15]

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.[24][18][43]

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.[13]

APT29 has used multiple command-line utilities to enumerate running processes.[12][29][17]

APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.[36][17]

A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.[24][25]

APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.[24]

APT29 has used RDP sessions from public-facing systems to internal servers.[17]

APT29 has used administrative accounts to connect over SMB to targeted users.[17]

APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts.[36]

APT29 has used AdFind to enumerate remote systems.[29]

APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.[12] They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.[9] APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion.[11] They previously used named and hijacked scheduled tasks to also establish persistence.[24]

APT29 has installed web shells on exploited Microsoft Exchange servers.[13]

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.[44]

APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.[29]

APT29 has stolen Chrome browser cookies by copying the Chrome profile directories of targeted users.[17]

APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.[9]

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.[33]

APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.[9][13][14][25]

APT29 has use mshta to execute malicious scripts on a compromised host.[33]

APT29 has used Rundll32.exe to execute payloads.[26][29][32]

APT29 used fsutil to check available free space before executing actions that might create large files on disk.[29]

APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.[10]

APT29 has gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.[13][17][25]

APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.[39][13]

APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.[39][14]

APT29 has used compromised service principals to make changes to the Office 365 environment.[17]

APT29 used Kerberos ticket attacks for lateral movement.[24]

APT29 used stolen cookies to access cloud resources, and a forged duo-sid cookie to bypass MFA set on an email account.[12][17]

APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.[32][22][18][43]

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. [3] [32][22][33][15]

APT29 used different compromised credentials for remote access and to move laterally.[9][10][13]

APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.[22][23][17]

APT29 has used compromised local accounts to access victims' networks.[17]

APT29 has used a compromised O365 administrator account to create a new Service Principal.[17]

APT29 has used social media platforms to hide communications to C2 servers.[22]

APT29 used WMI to steal credentials and execute backdoors at a future time.[24] They have also used WMI for the remote execution of files for lateral movement.[39][29]