216.73.217.22

CozyDuke

· Published 16/12/2025 19:39 · Modified 04/05/2026 16:33 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
04/05/2026 16:33
Updated at
04/05/2026 16:33
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
1 reports, 123 attack patterns (mitre), 41 malware, 7 sectors, 15 countries, 100 indicators, 1 vulnerabilities (cve), 14 tool

Aliases

IRON RITUAL IRON HEMLOCK NobleBaron Dark Halo NOBELIUM UNC2452 YTTRIUM The Dukes Cozy Bear SolarStorm Blue Kitsune UNC3524 Midnight Blizzard APT29

Description

[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021) In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (123)

Malware (41)

  • CozyDuke
  • SeaDuke - S0053 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 13/04/2026 10:46 · Modified 29/05/2026 12:20
  • JSObfuscated
  • WellMail
  • reGeorg
  • OnionDuke
  • LiteDuke
  • FatDuke
  • PowerDuke
  • Raindrop
  • ROOTSAW
  • HOMESTEEL uses
    Family
    Published 26/10/2024 07:55 · Modified 26/10/2024 07:55
  • QUIETEXIT uses
    Family The MITRE Corporation Confidence 100

    [QUIETEXIT](https://attack.mitre.org/software/S1084) is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021. [APT29](https://attack.mitre.org/groups/G0016) has deployed [QUIETEXIT](https://attack.mitre.org/software/S1084) on …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:36 · Modified 27/03/2026 01:03
  • CozyCar - S0046 uses
    Family
    Published 13/04/2026 08:41 · Modified 13/04/2026 08:41
  • BURNTBATTER
  • NativeZone
  • Sibot
  • FoggyWeb
  • APT29
  • SUNSPOT
  • GoldMax
  • GoldFinder
  • HustleCon uses
    Family
    Published 30/10/2024 22:04 · Modified 30/10/2024 22:04
  • CloudDuke - S0054 uses
    Family
    Published 13/04/2026 08:41 · Modified 13/04/2026 08:41
  • CosmicDuke
  • PolyglotDuke
  • SUNBURST
  • TrailBlazer
  • GeminiDuke
  • WellMess
  • EnvyScout
  • POSHSPY
  • MiniDuke
  • SeaDesk
  • RegDuke
  • Detects
  • Forkmeimfamous uses
    Family
    Published 13/04/2026 08:41 · Modified 13/04/2026 08:41
  • HAMMERTOSS
  • GRAPELOADER uses
    Family
    Published 15/04/2025 18:49 · Modified 15/04/2025 18:49
  • TEARDROP
  • CloudLook uses
    Family
    Published 13/04/2026 08:41 · Modified 13/04/2026 08:41

Sectors (7)

  • Defense targets
  • Diplomacy targets
  • Defense ministries (including the military) targets
  • Telecommunications targets
  • Ministries of foreign affairs targets
  • Technology targets
  • Government targets

Countries (15)

  • Italy targets
  • South Georgia and the South Sandwich Islands targets
  • Greece targets
  • Peru targets
  • France targets
  • Denmark targets
  • Belgium targets
  • Ireland targets
  • Russian Federation targets
  • Spain targets
  • Latvia targets
  • Czechia targets
  • Georgia targets
  • United Kingdom of Great Britain and Northern Ireland targets
  • Germany targets

Indicators (100)

  • eu-west-2-aws.s3-nato.cloud related
  • https://waterforvoiceless.org/invite.php related
  • eu-south-1-aws.gov-pl.cloud related
  • eu-central-2-aws.mzv-sk.cloud related
  • eu-central-1-aws.mindef-nl.cloud related
  • eu-west-1.aws-ukraine.cloud related
  • sseekk.xyz related
  • eu-east-1-aws.dep-no.cloud related
  • eu-central-1-aws.ncfta.cloud related
  • central-2-aws.ukrtelecom.cloud related
  • 24c079b24851a5cc8f61565176bbf1157b9d5559c642e31139ab8d76bbb320f8 related
  • eu-west-1.msz-pl.cloud related
  • eu-southeast-1-aws.aws-ukraine.cloud related
  • edadmin.kearsney.com related
  • siestakeying.com related
  • eu-west-3.ukrtelecom.cloud related
  • eu-north-1-aws.mil-pl.cloud related
  • eu-southeast-1-aws.gov-sk.cloud related
  • eu-west-3.mil-be.cloud related
  • eu-east-1-aws.amazonsolutions.cloud related
  • eu-central-1-aws.amazonsolutions.cloud related
  • eu-central-1-aws.regeringskansliet-se.cloud related
  • 72b92683052e0c813890caf7b4f8bfd331a8b2afc324dd545d46138f677178c4 related
  • eu-north-1-aws.gov-pl.cloud related
  • eu-west-2-aws.gov-pl.cloud related
  • eu-central-1.s3-be.cloud related
  • s3-nsa.cloud related
  • eu-north-1-aws.quirinale.cloud related
  • us-west-1-aws.gov-ua.cloud related
  • 761ed73512cb4392b98c84a34d3439240a73e389f09c2b4a8f0cce6a212f529c related
  • eu-west-2-aws.gv-at.cloud related
  • eu-south-2-aws.gov-pl.cloud related
  • s3-fbi.cloud related
  • us-west-1-amazon.ua-energy.cloud related
  • eu-north-1-aws.s3-be.cloud related
  • e477f52a5f67830d81cf417434991fe088bfec21984514a5ee22c1bcffe1f2bc related
  • eu-west-3-aws.aws-ukraine.cloud related
  • 85484716a369b0bc2391b5f20cf11e4bd65497a34e7a275532b729573d6ef15e related
  • us-east-1-aws.mfa-gov.cloud related
  • 4d92a4cecb62d237647a20d2cdfd944d5a29c1a14b274d729e9c8ccca1f0b68b related
  • spffusa.org related
  • eu-south-2-aws.msz-pl.cloud related
  • eu-west-3-aws.minbuza.cloud related
  • https://literaturaelsalvador.com/Instructions.html related
  • eu-south-2.gov-sk.cloud related
  • a018f4d5245fd775a17dc8437ad55c2f74fb6152dd4fdf16709a60df2a063fff related
  • eu-south-2-aws.mzv-sk.cloud related
  • 02214c0c7ee94e8efebd3bebe6f788ef3390d8a9 related
  • eu-central-2-aws.presidencia-pt.cloud related
  • d61ff2430473f06fc42a1d452597c610027aace2 related
  • eu-central-1.regeringskansliet-se.cloud related
  • ap-northeast-1-aws.s3-ua.cloud related
  • dda686d6fda52c6ab3c084b7024cfc68dba60ae2143a1095659b795f84cf2329 related
  • eu-north-1-aws.dep-no.cloud related
  • 103.226.132.7 related
  • c8ca2199aabae9af5c59e658d11a41f76af4576204c23bf5762825171c56e5e8 related
  • c62199ef9c2736d15255f5deaa663158a7bb3615ba9262eb67e3f4adada14111 related
  • crossfity.com related
  • eu-north-1-aws.minbuza.cloud related
  • eu-west-3-aws.gov-trust.cloud related
  • eu-west-3-aws.mil-pl.cloud related
  • visionresearch.com related
  • eu-south-2.dep-no.cloud related
  • totalconstruction.com.au related
  • 347715f967da5debfb01d3ba2ede6922801c24988c8e6ea2541e370ded313c8b related
  • eu-east-1-aws.mindef-nl.cloud related
  • eu-south-2.ua-sec.cloud related
  • ce9802b22a37ae26c02b1f2c3225955a7667495fce5b106113434ab5a87ae28a related
  • 09f0ea9b239385eb22f794dcecaec1273be87f3f118a2da067551778971ca677 related
  • eu-south-2-aws.dep-no.cloud related
  • eu-north-1.s3-ua.cloud related
  • secure.hgl.com related
  • eu-central-2-aws.s3-be.cloud related
  • 3739b2eae11c8367b576869b68d502b97676fb68d18cc0045f661fbe354afcb9 related
  • https://waterforvoiceless.org/util.php related
  • 62ce8e1489a8b87539792c07179faf1db1b46caa39b55902a4d82dcec44d72ae related
  • disknxt.com related
  • eu-west-3-aws.s3-be.cloud related
  • ca-central-1.ua-gov.cloud related
  • 122.228.193.115 related
  • eu-north-1-aws.ua-energy.cloud related
  • eu-central-1.difesa-it.cloud related
  • eu-west-2-aws.dep-no.cloud related
  • eu-north-1.s3-be.cloud related
  • 7600d4bb4e159b38408cb4f3a4fa19a5526eec0051c8c508ef1045f75b0f6083 related
  • us-west-1-amazon.ua-sec.cloud related
  • eu-west-1-aws.gov-ua.cloud related
  • 773f0102720af2957859d6930cd09693824d87db705b3303cef9ee794375ce13 related
  • 4ee70128c70d646c5c2a9a17ad05949cb1fbf1043e9d671998812b2dce75cf0f related
  • silry.com related
  • adfe0ef4ef181c4b19437100153e9fe7aed119f5049e5489a36692757460b9f8 related
  • bc9ad574c42bc7b123baaafb3325ce2185e92e46979b2faaddd4bc80ddfac88a related
  • eu-west-1.gov-sk.cloud related
  • eu-west-2-aws.amazonsolutions.cloud related
  • eu-north-1.difesa-it.cloud related
  • 19442634bc2e0bfa6d08b7be333a351b932a517a1002c0e1c49fea8381372a6e related
  • eu-central-1-aws.msz-pl.cloud related
  • eu-west-1-aws.s3-esa.cloud related
  • c1ebaee855b5d9b67657f45d6d764f3c1e46c1fa6214329a3b51d14eba336256 related
  • eu-west-1-aws.ua-sec.cloud related

Vulnerabilities (CVE) (1)

CVE-2025-55182 KEV
10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector
Network
Published
05/12/2025
Modified
29/05/2026
Analyzed

Tool (14)

  • Tasklist uses
    The MITRE Corporation Confidence 100

    The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • ipconfig uses
    The MITRE Corporation Confidence 100

    [ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • AADInternals uses
    The MITRE Corporation Confidence 100

    [AADInternals](https://attack.mitre.org/software/S0677) is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.(Citation: AADInternals Github)(Citation: AADInternals Documentation)

    Published 01/02/2022 16:08 · Modified 27/03/2026 01:07
  • Tor uses
    The MITRE Corporation Confidence 100

    [Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the …

    Published 16/01/2018 17:13 · Modified 27/03/2026 01:07
  • AdFind uses
    The MITRE Corporation Confidence 100

    [AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • PsExec uses
    The MITRE Corporation Confidence 100

    [PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • SDelete uses
    The MITRE Corporation Confidence 100

    [SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete …

    Published 18/04/2018 19:59 · Modified 27/03/2026 01:07
  • meek uses
    The MITRE Corporation Confidence 100

    [meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Systeminfo uses
    The MITRE Corporation Confidence 100

    [Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • BloodHound uses
    The MITRE Corporation Confidence 100

    [BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • ROADTools uses
    The MITRE Corporation Confidence 100

    [ROADTools](https://attack.mitre.org/software/S0684) is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.(Citation: ROADtools Github)

    Published 18/02/2022 14:29 · Modified 27/03/2026 01:07
  • Sliver uses
    The MITRE Corporation Confidence 100

    [Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional …

    Published 30/07/2021 17:43 · Modified 27/03/2026 01:07
  • Impacket uses
    The MITRE Corporation Confidence 100

    [Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, …

    Published 31/01/2019 02:39 · Modified 27/03/2026 01:07