APT29 has use

APT29 has obtained and used a variety of tools including

Mimikatz,

SDelete,

Tor,

meek, and

Cobalt Strike.(Citation: Mandiant No Easy Breach)(Citation: F-Secure The Dukes)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.(Citation: SentinelOne NobleBaron June 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

APT29 has conducted brute force password spray attacks.(Citation: MSRC Nobelium June 2021)(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.(Citation: MSTIC NOBELIUM May 2021)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT29 has installed web shells on exploited Microsoft Exchange servers.(Citation: Cybersecurity Advisory SVR TTP May 2021)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.(Citation: Cybersecurity Advisory SVR TTP May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|