APT28 and APT29: Russian State-Sponsored Cyber Operations Explained

Two Groups, Two Intelligence Services

Russia maintains two major APT (Advanced Persistent Threat) groups, each tied to a different intelligence service:

APT28 (Fancy Bear, Sofacy, Pawn Storm, Strontium) is attributed to Unit 26165 of the GRU (Russian military intelligence). Its operations are often aggressive, rapid, and focused on political destabilization.

APT29 (Cozy Bear, Nobelium, Midnight Blizzard, The Dukes) is attributed to the SVR (Russian foreign intelligence service). Its operations are stealthier, more patient, and oriented toward long-term strategic intelligence.

APT28: Notable Operations

DNC Hack (2016)

APT28 compromised the Democratic National Committee's systems and exfiltrated thousands of emails that were published by WikiLeaks during the U.S. presidential campaign. The objective was political destabilization.

Vector: targeted spear phishing with links to fake Google login portals.

TV5Monde Hack (2015)

APT28 took control of French broadcaster TV5Monde's systems, interrupting broadcasts for several hours. The attack was initially attributed to ISIS (a false flag) before France's ANSSI attributed it to the Russian group.

European Election Campaigns

APT28 targeted electoral processes in France (2017), Germany (Bundestag, 2015), and other European countries. Techniques include spear phishing, email account compromise, and publication of stolen documents.

APT29: Notable Operations

SolarWinds (2020)

The SolarWinds Orion compromise is the most sophisticated operation attributed to APT29. Inserting a backdoor into the build process of software used by 18,000 organizations demonstrates exceptional technical capability and patience.

Microsoft Compromise (2023-2024)

APT29 accessed emails of Microsoft senior executives by exploiting a legacy test account that did not have MFA enabled. The attack used password spraying and allowed the group to read emails of security leadership and legal executives at Microsoft.

COVID-19 Vaccine Lab Targeting (2020)

During the pandemic, APT29 targeted pharmaceutical laboratories working on COVID-19 vaccines in the UK, the US, and Canada. The objective was intellectual property theft.

Comparative Tactics, Techniques, and Procedures

APT28:

APT29:

Implications for European Businesses

French and European companies are regular targets of these groups, particularly:

Recommended Defenses

Strengthened authentication: phishing-resistant MFA (FIDO2) is essential for high-privilege accounts.

Lateral movement detection: APTs move slowly through networks. Detecting unusual connections between systems is critical.

Cloud access monitoring: both groups use legitimate cloud services. Monitor unusual OAuth access and tenant configurations.

Red team exercises: simulate these groups' TTPs to test your defenses.

The APT threat is real for French businesses, including SMBs that are part of the supply chain of strategic enterprises. CleanIssue helps identify the attack surfaces these groups exploit.