APT29

APT29 has bypassed UAC.^[7]

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS.^[8]

APT29 added Registry Run keys to establish persistence.^[7]

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell scripts to evade defenses.^[10][7][9]

APT29 has used steganography to hide C2 communications in images.^[5]

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.^[11][12]

APT29 used sticky-keys to obtain unauthenticated, privileged console access.^[7][13]

APT29 used SDelete to remove artifacts from victims.^[7]

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.^[1][9][5]

A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.^[7]

APT29 used named and hijacked scheduled tasks to establish persistence.^[7]

APT29 has used rundll32.exe for execution.^[9]

APT29 used Kerberos ticket attacks for lateral movement.^[7]

APT29 has used various forms of spearphishing attempting to get a user to open links or attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. ^{[1] [9][5]}

APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.^[5][6]

APT29 has used social media platforms to hide communications to C2 servers.^[5]