APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.(Citation: Mandiant No Easy Breach)(Citation: MSTIC NOBELIUM May 2021)(Citation: Secureworks IRON RITUAL USAID Phish May 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.(Citation: F-Secure The Dukes)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: MSTIC NOBELIUM May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|A backdoor used by

APT29 created a

Tor hidden service to forward traffic from the

Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.004|Domain Fronting|

APT29 has used the meek domain fronting plugin for

Tor to hide the destination of C2 traffic.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT29 used UPX to pack files.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1550.003|Pass the Ticket|

APT29 used Kerberos ticket attacks for lateral movement.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|