Some threat actors follow trends. Others define them. 

APT29, also known as Midnight Blizzard or NOBELIUM, sits firmly in the second category. Over more than a decade, this Russian state-sponsored group has consistently redefined how modern cyber espionage operates—quietly, patiently, and with surgical precision. 

From spearphishing campaigns to supply chain compromises and now malware-free attacks leveraging trusted tools, APT29 demonstrates a single truth: attackers evolve faster than traditional defenses. 

This campaign explores how APT29 operates today, how its tactics have evolved, and what this means for defenders preparing for real-world incidents. 

Understanding APT29 (Midnight Blizzard) 

APT29 is a highly sophisticated cyber espionage group attributed to Russia’s Foreign Intelligence Service (SVR). Its mission is clear: collect intelligence from foreign governments, diplomatic entities, and strategic organizations. 

Unlike disruptive threat actors, APT29 prioritizes stealth and persistence. It maintains long-term access to target environments, often remaining undetected for extended periods while quietly extracting sensitive data. 

The group operates under multiple aliases, including Midnight Blizzard / NOBELIUM (Microsoft), Cozy Bear (CrowdStrike), and The Dukes (security community). 

Its targets reflect strategic intent: 

• Government and diplomatic organizations 

• Defense contractors and think tanks 

• IT service providers and cloud environments 

 APT29’s campaigns are not opportunistic. They are deliberate, intelligence-driven operations designed to achieve geopolitical objectives. 

Key attack definitions 

Before diving into the latest campaign, it is important to understand several key techniques APT29 relies on: 

Spearphishing (T1566.001) 
Targeted phishing emails crafted for specific individuals, often using highly relevant lures. 

Supply chain compromise (T1195.002) 
Embedding malicious code into trusted software updates to gain access to downstream customers. 

Valid account abuse (T1078) 
Using legitimate credentials to access systems without triggering traditional alerts. 

Living off the land (LOTL) 
Leveraging native tools and legitimate system functionality instead of deploying malware. 

Cloud identity attacks 
Compromising authentication systems, tokens, or identity infrastructure in cloud environments. 

These techniques share a common theme: blending in. APT29 avoids noisy tactics in favor of methods that look legitimate. 

Anatomy of the attack chain 

When you examine APT29 campaigns over time, and the pattern becomes clear and focuses on evolving the delivery while preserving the objective. 

Phase 1: Traditional intrusion (2016) 

The group relied on spearphishing attachments and social media-based command-and-control (C2). It introduced innovative techniques like hiding commands in images hosted on platforms such as Twitter (now X) and GitHub. 

Phase 2: Supply chain dominance (2020) 

The SolarWinds attack marked a turning point. APT29 gained access to approximately 18,000 organizations globally by compromising software updates. 

Key characteristics of this campaign included: 

• Dormant malware to evade detection 

• Legitimate-looking network traffic 

• Deep lateral movement inside enterprise environments 

Phase 3: Cloud-native compromise (2023) 

APT29 shifted focus to identity and cloud infrastructure. 

Attack chain highlights:  

• Initial access via password spraying against accounts without MFA 

• Persistence using malicious OAuth applications 

• Defense evasion through stolen authentication tokens 

• Collection targeting executive email communications 

 This phase introduced advanced implants like FOGGYWEB and MAGICWEB, designed to manipulate authentication flows. 

Phase 4: Malware-free operations (2024 Rogue RDP campaign) 

This campaign represents a major tactical shift. Instead of malware, APT29 used malicious .RDP configuration files delivered via phishing emails.  

With this approach, the group managed to avoid traditional malware detection, exploit trust in signed files and native tools, and expand targeting at scale across organizations. 

Phase 5: Continued innovation (2025 campaigns) 

 APT29 continues to refine its approach with campaigns targeting European diplomats using social engineering lures like event invitations. 

New tools such as GRAPELOADER and WINELOADER introduce: 

• DLL side-loading for stealth execution 

• Advanced anti-analysis techniques 

• Multi-stage payload delivery 

What you’ll learn 

This campaign is not just about APT29. It is about how modern threats behave and how defenders need to respond. 

By the end of this campaign, you will understand: 

• How state-sponsored actors evolve tactics across years, not weeks 

• Why malware-free attacks challenge traditional detection models 

• How identity, cloud, and trusted tools become primary attack surfaces 

• What “living off the land” looks like in real-world operations 

• Why behavioral detection and process monitoring matter more than signatures 

Most importantly, you will see how attack chains unfold in practice and where defensive gaps emerge under pressure. 

You can dive into the introductory theory module on APT29, and then test your newfound knowledge with three Hands-on Labs, all available for free:  

• APT29 Initial Access and Reconnaissance  

• APT29 Persistence and Exfiltration  

• APT29 Detection and Indicators of Compromise