APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.(Citation: ESET T3 Threat Report 2021) |
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.(Citation: ANSSI Nobelium Phishing December 2021)(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1087.004|Cloud Account|

APT29 has conducted enumeration of Azure AD accounts.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,IaaS,Google Workspace,SaaS|T1136.003|Cloud Account|

APT29 can create new users through Azure AD.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

APT29 has used multiple layers of encryption within malware to protect C2 communication.(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.(Citation: ESET T3 Threat Report 2021)|
|mitre-attack|enterprise-attack|Windows|T1553.005|Mark-of-the-Web Bypass|

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.(Citation: ESET T3 Threat Report 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

APT29 has use

APT29 has obtained and used a variety of tools including

Mimikatz,

SDelete,

Tor,

meek, and