Anas SahelIdentity & security

Threat watch / Threat actors

APT29

State-linked updated 7 Nov 2026

A threat group active since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes and think tanks.

Also known as
Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, UNC2452
Attribution

MITRE ATT&CK lists APT29 as attributed to Russia's Foreign Intelligence Service (SVR). [1]

Incidents in the watch

  1. Plerdy analytics script hijacked to serve phone exploits High

← All threat actors