APT29 (Midnight Blizzard) Threat Actor Profile

APT29 is a Russian foreign intelligence group that has learned to live inside cloud identity systems, turning forgotten test accounts, OAuth applications, service accounts and device registrations into long-term access to email and source code. The US and UK governments attribute it to the SVR, Russia's Foreign Intelligence Service. This profile covers its names, targeting, the ATT&CK techniques defenders should prioritise, the identity abuse patterns behind its best-known intrusions, and the detections and controls that counter them. It is written for identity, cloud security and security operations teams, especially those running Microsoft Entra ID and Microsoft 365. For the wider landscape of threat groups, see the Threat Actor Groups Guide.

Key takeaways

Non-human identities are a favourite target. Service accounts, legacy OAuth applications and app-only permissions gave APT29 mailbox access at Microsoft in the intrusion detected in January 2024, and the joint advisory AA24-057A names service and dormant accounts as primary entry points.
Low-volume password spraying still works. One account without MFA in a non-production tenant was enough to start the Microsoft corporate email intrusion.
Legitimate authentication features are turned against users. Device code flow, application-specific passwords, signed RDP files and device registration have all been abused since 2024.
Supply chain and build systems give scale. SolarWinds in 2020 and JetBrains TeamCity CVE-2023-42793 in 2023 showed the group exploiting software suppliers and developer infrastructure.
Defence is mostly identity hygiene done thoroughly. Inventory and remove unused apps and accounts, restrict consent and app-only mail permissions, block device code flow where unused, and use phishing-resistant MFA everywhere, including test tenants.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as G0016 APT29. Microsoft calls it Midnight Blizzard (formerly NOBELIUM) and states that the US and UK governments tie it to the SVR. Its operations are aimed at long-term intelligence collection rather than disruption, which is why it invests in stealth and persistence.

Name	Who uses it	Notes
APT29	MITRE ATT&CK, most vendors, government advisories	Most widely used name
Midnight Blizzard (formerly NOBELIUM, YTTRIUM)	Microsoft	Used in Microsoft detections and responder guidance
Cozy Bear, CozyDuke, The Dukes	Press and earlier vendor reporting	Older names tied to malware families
UNC2452, Dark Halo, SolarStorm	Vendors during the SolarWinds response	Listed by ATT&CK
UNC3524	Listed by ATT&CK	Associated cluster listed under G0016
IRON RITUAL, IRON HEMLOCK, NobleBaron, Blue Kitsune	Other vendors listed by ATT&CK	Overlapping clusters
Storm-2945	Microsoft	Described by Microsoft in 2026 as a sub-cluster of Midnight Blizzard

APT29 is distinct from APT28 and Sandworm, which belong to the GRU military intelligence service. Google tracks some 2025 activity as UNC6293 and links it to APT29 only with low confidence, so treat that cluster as related rather than identical.

Targeting and motivation

Governments and diplomats: foreign ministries, embassies and government departments in NATO and EU states and beyond.
Technology and cloud providers: Microsoft, its customers and IT service providers, because access to a provider can expose many downstream tenants.
Software supply chain: build servers and software vendors, as in SolarWinds and the opportunistic TeamCity campaign that compromised a few dozen companies across the US, Europe, Asia and Australia.
Think tanks, academics, NGOs and journalists: the 2025 application-specific password campaign targeted prominent academics and critics of Russia, and later journalists.
Higher education, defence and NGOs at volume: the October 2024 RDP spearphishing campaign reached thousands of targets in more than 100 organisations.
Travelling staff: the 2026 CaptiveCrunch activity compromised hotel and conference centre captive portals, suggesting any travelling employee with access to valuable data is in scope.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 maps 66 active techniques to G0016. The selection below focuses on cloud and identity behaviour seen in advisories since 2023.

Tactic	Technique	How it shows up	Primary control
Credential access	T1110.003 Password Spraying	Low-volume spraying through residential proxies (T1090.002)	MFA on every account, risk-based sign-in policies
Initial access	T1078.004 Cloud Accounts	Service accounts and dormant accounts of former staff	Account lifecycle, canary accounts
Credential access	T1528 Steal Application Access Token	Stolen tokens used without the password; device code phishing	Short token lifetimes, block device code flow
Credential access	T1621 Multi-Factor Authentication Request Generation	Repeated push prompts until a user approves	Number matching or phishing-resistant MFA
Persistence	T1098.005 Device Registration	Actor-controlled device registered in the tenant	Restrict device registration and require strong MFA
Persistence	T1136.003 Cloud Account, T1098.001 Additional Cloud Credentials	New user created to consent to malicious OAuth apps; credentials added to apps	Alert on app credential and consent changes
Privilege escalation	T1098.003 Additional Cloud Roles	App granted full_access_as_app in Exchange Online	Review app roles and admin consent
Credential access	T1606.002 SAML Tokens, T1556.007 Hybrid Identity	Forged SAML tokens and tampering with federation during the SolarWinds campaign	Protect token-signing keys, monitor federation changes
Credential access	T1649 Steal or Forge Authentication Certificates	Access to privileged certificates	Audit certificate access and issuance
Initial access	T1195.002 Compromise Software Supply Chain, T1190 Exploit Public-Facing Application	SolarWinds Orion update; TeamCity CVE-2023-42793	Build system hardening, rapid patching
Initial access	T1566.001, T1566.002 Spearphishing Attachment and Link	Signed RDP files, State Department themed lures, watering hole redirects	Block outbound RDP, mail filtering
Collection	T1114.002 Remote Email Collection	Mail read through Exchange Web Services and Graph	MailItemsAccessed auditing
Defense impairment	T1685.002 Disable or Modify Cloud Log	Reducing cloud audit visibility	Alert on audit policy changes

How they abuse identities and credentials

Most recent APT29 intrusions follow the same identity chain: get one credential, find an identity with more privilege that nobody watches, then create persistence that looks like normal administration.

Forgotten non-production identities: in the intrusion Microsoft detected on 12 January 2024, a legacy test tenant account without MFA fell to password spraying, and a legacy test OAuth application gave elevated access to the corporate environment. See the Microsoft Midnight Blizzard breach analysis.
App-only mailbox access: the actor used the application to grant the full_access_as_app role in Office 365 Exchange Online, then read corporate email over EWS. Microsoft's guidance is to review any app holding EWS.full_access_as_app, EWS.AccessAsUser.All or ApplicationImpersonation and to scope apps with RBAC for Applications. See the Entra ID Applications and Consent Guide.
Service and dormant accounts: AA24-057A explains that service accounts are often highly privileged and hard to put behind MFA, and that the SVR regained access by signing in to dormant accounts after incident response password resets. See the Service Account Security Guide.
Token theft and device registration: stolen access tokens remove the need for a password, and registering an actor-controlled device creates durable access wherever device validation rules are missing.
Device code and application password social engineering: in 2025 Google reported targets being persuaded to create and share Google application-specific passwords, and calendar invites aiming to link an attacker device through Microsoft's device code flow. Amazon disrupted an APT29 watering hole in August 2025 that sent visitors to fake Cloudflare pages leading to device code abuse. See the Device Code Phishing Guide.
Federation and signing keys: during the SolarWinds campaign the actor forged SAML tokens and abused application identities in Azure AD tenants. See the SolarWinds supply chain compromise and the Malwarebytes breach, where an application identity was used to read internal email.
Credentials from build servers: after exploiting TeamCity the SVR dumped credentials, crafted Kerberos tickets and exfiltrated SAM, SYSTEM and SECURITY registry hives, giving it secrets for CI/CD pipelines. See the TeamCity CVE-2023-42793 exploitation analysis.

Notable incidents

Date	Event	Source	Lesson for defenders
Dec 2020	SolarWinds Orion supply chain compromise, with forged SAML tokens and app identity abuse in victim tenants	US government attribution to the SVR	Protect identity provider signing material and app credentials
Sep to Dec 2023	Exploitation of TeamCity CVE-2023-42793 from late September 2023; joint advisory AA23-347A in December	FBI, CISA, NSA and partners	Unpatched build servers expose code signing and pipeline secrets
Jan 2024	Microsoft corporate email intrusion via a test tenant account and legacy OAuth app, detected 12 January 2024	Microsoft	Test tenants and legacy apps need production-grade controls
Feb 2024	AA24-057A on SVR cloud access techniques	NCSC-UK with NSA, CISA, FBI and Five Eyes partners	Service accounts, dormant accounts and device enrolment are priority controls
Oct 2024	Spearphishing with signed RDP files to thousands of targets in over 100 organisations	Microsoft Threat Intelligence	Block outbound RDP to the internet
Apr to Jul 2025	Application-specific password and device code social engineering against academics and critics of Russia (UNC6293, low-confidence link)	Google Threat Intelligence Group	High-risk users need programmes that block app passwords
Aug 2025	Amazon disrupts an APT29 watering hole using fake Cloudflare pages and device code flow abuse	Amazon, as reported by The Hacker News	Block device code flow where it is not needed
May to Jul 2026	CaptiveCrunch: compromise of hotel and conference centre captive portals, active since early May 2026, attributed by Microsoft to Storm-2945	Microsoft Threat Intelligence, as reported by iTnews	Treat guest Wi-Fi as hostile and use full-tunnel VPN

Detection and defence

Priority controls

Find every identity nobody owns: inventory OAuth applications, service principals, service accounts and test tenants, assign owners and remove unused ones. Pay attention to app-only permissions to mail and files. See the SaaS and OAuth App Governance Guide.
Apply the same MFA bar to every tenant: phishing-resistant MFA through Conditional Access authentication strength for all users, including non-production tenants, and avoid telephony factors. See the Conditional Access Guide.
Restrict consent and app permissions: require admin approval for consent, remove ApplicationImpersonation where unused, and scope app-only Exchange access with RBAC for Applications.
Close risky authentication flows: block device code flow with Conditional Access where it is not needed, restrict device registration to managed devices with strong MFA, and disable application passwords and legacy authentication.
Shorten token life and plan revocation: keep session lifetimes as short as practical, and make sure incident response revokes refresh tokens, app credentials and registered devices, not only passwords.
Harden build and edge systems: patch internet-facing developer tools quickly, bring test and development systems under the security baseline, and block outbound RDP to public networks.
Deploy canary service accounts: AA24-057A recommends accounts that look valid but are never used, so any sign-in is a high-confidence alert.

What to monitor

Signal	Log source or detection	Why it matters
Password spray patterns from residential IPs	Entra ID sign-in logs, Entra ID Protection password spray detection, Sentinel rule SigninPasswordSpray	Initial access
App granted full_access_as_app or new high-privilege app role	Entra ID audit log, Sentinel rule ExchangeFullAccessGrantedToApp	Mailbox access through an app identity
New OAuth app created and consented by a recently created user	Entra ID audit log, Defender for Cloud Apps alerts	Persistence pattern from the Microsoft intrusion
Spikes in EWS calls or MailItemsAccessed by app-only identities	Microsoft Purview Audit, CloudAppEvents	Collection
Device code flow sign-ins	Entra ID sign-in logs, authentication protocol field	Device code phishing
New device registrations after risky sign-ins	Entra ID audit log	T1098.005 persistence
Sign-ins to dormant or canary accounts	IdP sign-in logs	High-confidence compromise signal
Federation or token-signing changes	Entra ID audit log (domain federation settings)	T1556.007, T1606.002

Metrics that show progress

Ownerless applications: number of service principals and OAuth apps without an assigned owner, trending to zero.
App-only mail access: number of apps with tenant-wide mailbox permissions, and percentage scoped by RBAC for Applications.
MFA coverage: percentage of accounts, including non-production tenants, covered by phishing-resistant MFA.
Dormant accounts: count of enabled accounts with no sign-in for 90 days.
Device code exposure: percentage of users covered by a Conditional Access policy blocking device code flow.
Revocation time: minutes from confirmed compromise to revocation of tokens, app credentials and devices.

Common failure patterns

Treating test tenants as out of scope: the Microsoft intrusion started in a non-production tenant with no MFA.
Password resets as the whole response: dormant accounts, app credentials, registered devices and refresh tokens keep the actor in, as AA24-057A describes.
Legacy apps keeping broad permissions: an old OAuth app with elevated access became the escalation path.
Leaving device code flow open for everyone: it was abused in at least two separate 2025 campaigns.
Trusting signed files and familiar brands: RDP files signed with a valid certificate and State Department themed lures both succeeded.

Framework mapping

Defence area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	ATT&CK techniques addressed
Account and application lifecycle	AC-2	PR.AA-01	T1078.004, T1136.003
Phishing-resistant MFA and authenticator management	IA-2, IA-5	PR.AA-01	T1110.003, T1621, T1528
Least privilege for apps and service accounts	AC-6	PR.AA-05	T1098.003, T1114.002
Vulnerability management for build and edge systems	RA-5	ID.RA-03	T1190, T1195.002
Cloud monitoring and log review	SI-4, AU-6	DE.CM-03	T1098.005, T1685.002, T1606.002

Practitioner checklist

Map APT29 aliases (Midnight Blizzard, NOBELIUM, Cozy Bear, UNC2452, Storm-2945) in your threat intelligence platform.
Inventory every OAuth app, service principal and service account, assign owners and remove what is unused.
Enforce phishing-resistant MFA in every tenant, including test and development tenants.
Review apps holding full_access_as_app, EWS.AccessAsUser.All or ApplicationImpersonation and scope them.
Block device code flow and legacy authentication where not needed, and restrict device registration.
Create canary service accounts and alert on any sign-in to them or to dormant accounts.
Make incident response revoke tokens, app credentials and devices, not just passwords.
Block outbound RDP to the internet and patch internet-facing developer tools within days.
Give travelling and high-risk staff full-tunnel VPN and enrolment in high-assurance account programmes.

APT29 (Midnight Blizzard) Threat Actor Profile: Cloud Identity Abuse and Defences