APT29
Nation-state Espionage Russia Active
Aliases: Cozy Bear · Nobelium · Midnight Blizzard · The Dukes · Cozy Duke · UNC2452 · Cloaked Ursa
Also seen as: NOBELIUM
- Mentions
- 5
- First seen
- 22 May 2026
- Last seen
- 05 Nov 2026
Relevant to you · Relevant
- Threat focus:
- espionage / aptindustrial / ot espionage
- Sector / region:
- Manufacturing
Origin
Russia — Russian foreign intelligence (SVR)
Profile
APT29 is a Russian state-sponsored cyber actor. Recent reporting describes watering hole attacks targeting thousands of mobile users and hijacking web analytics scripts to deliver iOS and Android exploits. SentinelOne blocked the CaptiveCrunch campaign. The actor also used Claude to rebuild malware and employs ROADtools for cloud tactics.
Affected vendors
MicrosoftPlerdy
Targeted sectors
MobileCloud
Associated malware / tools
ROADtoolsCaptiveCrunch
Activity (8 weeks)
Recent activity
- APT29's Watering Holes Target Thousands of Mobile Users darkreading
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits The Hacker News
- How SentinelOne Blocked APT29's CaptiveCrunch Campaign Cybersecurity Blog | SentinelOne
- Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection The Hacker News
- Paved With Intent: ROADtools and Nation-State Tactics in the Cloud Unit 42