Procedure examples

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.

APT29 has used Dynamic DNS providers for their malware C2 infrastructure.

APT29 has used multiple layers of encryption within malware to protect C2 communication.

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.

APT29 has used unique malware in many of their operations.

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.

APT29 has used repeated MFA requests to gain access to victim accounts.

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.

APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.

APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.

APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.