APT29 is the SVR's cyber arm, and they operate like an intelligence service: patient, methodical, and almost invisible. Where APT28 (GRU) moves fast and burns infrastructure for speed, APT29 measures dwell time in months and years. They pioneered the supply chain attack model that the entire industry now fears (SolarWinds, 2020: 18,000+ organizations compromised through a single build pipeline). In January 2024, they breached Microsoft's own corporate email systems and remained inside reading senior leadership mailboxes for weeks.

Their most significant evolution is the shift to cloud-native operations. CISA and NCSC advisories (2024) document APT29 abandoning traditional on-prem malware in favor of Azure AD/Entra ID abuse, OAuth token theft, SAML forgery, device enrollment manipulation, and residential proxy infrastructure. Post-SolarWinds APT29 looks almost nothing like pre-SolarWinds APT29: they operate in the identity layer, not the endpoint.

• Supply chain compromise. SolarWinds Orion (SUNBURST/SUNSPOT, 2020). Trojanized build pipeline injected a backdoor into signed software updates distributed to 18,000+ customers. The defining supply chain attack.
• CVE-2023-42793 JetBrains TeamCity. Authentication bypass allowing arbitrary code execution on CI/CD servers. Mass exploitation confirmed in joint FBI/NSA/NCSC advisory (October 2024).
• CVE-2022-27924 Zimbra command injection. Targeted hundreds of domains worldwide, injecting memcache commands to steal credentials and access mailboxes without user interaction.
• Password spraying against cloud identity providers (Azure AD, Okta, Google Workspace). Low-and-slow attempts through residential proxy infrastructure to avoid rate limiting and geofencing.
• OAuth consent phishing. Tricking users into granting permissions to malicious OAuth applications. Once consented, the app has persistent access to email, files, and calendar regardless of password changes.
• Device code phishing. Sending phishing emails with device authorization codes that victims enter at legitimate Microsoft login pages, granting the attacker a valid token without needing the password or MFA response.
• Spearphishing with HTML smuggling. EnvyScout HTML attachments that assemble the payload in the browser, bypassing email gateway inspection of attachments.

This is what separates APT29 from every other actor. They don't just use the cloud, they operate natively inside the identity and trust layer.

1. 1. Audit all OAuth application consent grants Search Azure AD/Entra ID for application consent events, especially apps granted Mail.Read, Mail.ReadWrite, Mail.Send, or full_access_as_app. Check for multi-tenant apps created recently, apps with no organizational publisher, and apps consented by compromised accounts. One documented case involved 17,000 multitenant OAuth apps from a single campaign. Azure AD: Enterprise Applications · Audit logs: "Consent to application" · Graph API: oauth2PermissionGrants
2. 2. Check for AD FS signing certificate access If you run AD FS, the signing certificate is the keys to the kingdom. Golden SAML requires the AD FS token-signing certificate's private key. Check for: unauthorized access to the AD FS server, exports of the signing certificate, and SAML tokens with unusual claims or lifetimes. If the certificate is compromised, rotate it immediately and revoke all issued tokens. HOST: Credential Access · AD FS audit logs · Security EID 4662 on AD FS service account
3. 3. Audit service principal credentials Service principals can have passwords or certificates added as credentials. Search for: newly created service principal credentials (Audit log: "Add service principal credentials"), service principals with multiple credentials, and service principals authenticating from unusual IPs. These are invisible access paths that bypass all user-level monitoring. Azure AD Audit: "Add service principal credentials" · Sign-in logs (service principal tab)
4. 4. Check for device enrollment anomalies Search Intune/Entra ID for devices enrolled during the compromise window, especially devices that don't match your hardware inventory. An attacker-enrolled device becomes a trusted endpoint that passes conditional access checks. Look for: device registrations from unusual IPs, devices with generic or out-of-pattern names, and devices that were enrolled and immediately used for authentication. Azure AD: Devices · Intune: Device enrollment audit
5. 5. Hunt for password spraying through residential proxies APT29 uses residential proxy services (not VPNs or VPS hosting) so their authentication attempts appear to come from normal broadband connections. Traditional "failed login from foreign IP" rules don't catch this. Look for: distributed low-volume failed authentications (1-2 per account per day) across many accounts from many different residential ISP IP ranges. The pattern is in the breadth and consistency, not the volume. Azure AD sign-in logs: filter by failure + ASN analysis · Compromised Credentials playbook
6. 6. Check for mailbox delegation and permission changes APT29 adds FullAccess or impersonation rights to target mailboxes so they can read email without generating sign-in events under the target's identity. Search Exchange/M365 audit logs for: Add-MailboxPermission, Set-Mailbox -GrantSendOnBehalfTo, and application impersonation role assignments during the compromise window. Search-UnifiedAuditLog -Operations "Add-MailboxPermission" · BEC playbook
7. 7. Review software supply chain integrity If your organization uses SolarWinds, JetBrains TeamCity, Zimbra, or managed service providers, verify build pipeline integrity. Check for: unauthorized changes to CI/CD configurations, unexpected build artifacts, software updates from untrusted sources, and MSP admin accounts with excessive permissions. APT29 targets the upstream provider to compromise the downstream customer. CI/CD pipeline audit logs · Software signing verification
8. 8. Hunt for HTML smuggling delivery APT29's EnvyScout delivers payloads via HTML email attachments that assemble the malware in the browser, bypassing email gateway file inspection. Search for: HTML attachments in email logs, Sysmon EID 11 for ISO/IMG/VHD files created from browser processes, and mounted disk image files that contain LNK or DLL payloads. HOST: Execution · HOST: Defense Evasion · Sysmon EID 11
9. 9. Check for SAML token anomalies Golden SAML tokens forged by APT29 may have: unusually long lifetimes, claims that don't match the user's actual attributes, tokens issued from unexpected AD FS servers, or tokens used from IPs that don't match the issuing server's network. If you have AD FS claim logging enabled, audit for anomalies in token issuance patterns. AD FS audit logs · Azure AD sign-in logs: "Token issuer" field
10. 10. Look for lateral movement via trusted applications Post-compromise, APT29 moves laterally using legitimate cloud admin tools (Azure Portal, Graph API, Exchange PowerShell) rather than deploying implants. Their post-access activity looks like a cloud administrator doing their job. The anomaly is which account is doing it and from where, not what tool they're using. Azure Activity Log · Graph API audit · Exchange admin audit log

Speed vs patience. APT28 operates in days to weeks with aggressive credential harvesting and quick exploitation. APT29 operates in months to years with careful, selective targeting. If the intrusion feels rushed, it's more likely APT28.

Endpoints vs identity. APT28 deploys custom tools on endpoints (GooseEgg, X-Agent, Drovorub). APT29 increasingly avoids endpoint artifacts entirely, operating in the cloud identity layer (OAuth, SAML, service principals). If there's no malware on any host and the compromise is entirely cloud-based, it's more likely APT29.

Breadth vs selectivity. APT28 runs mass campaigns (password spraying thousands of accounts, phishing entire organizations). APT29 compromises one supply chain and then carefully selects which of the 18,000 affected organizations to pursue further. If the initial access was broad but the follow-on activity is highly selective, it's more likely APT29.

Different GRU vs SVR. APT28 is GRU (military intelligence, Unit 26165). APT29 is SVR (foreign intelligence service). They have different chains of command, different mission sets, and different operational philosophies. They occasionally target the same organizations independently (the DNC hack in 2016 involved both groups, apparently unaware of each other).

CISA AA24-057A (February 2024): SVR cyber actors adapt tactics for initial cloud access. Details residential proxy, service account, and OAuth abuse.
FBI/NSA/NCSC Joint Advisory (October 2024): Mass exploitation of Zimbra and TeamCity by SVR actors.
Microsoft Midnight Blizzard disclosure (January 2024): SVR actors breached Microsoft corporate email via password spray against a legacy test tenant.
SolarWinds comprehensive timeline (2020-2021): SUNBURST backdoor, SUNSPOT build implant, TEARDROP/Raindrop second-stage loaders, Golden SAML post-compromise.

APT28 / Fancy Bear (the noisier GRU counterpart for comparison)
Compromised Credentials (APT29's primary operational mode is credential and token abuse)
Business Email Compromise (OAuth app and mailbox delegation abuse overlap)
Living-off-the-Land Activity (APT29's cloud operations are the identity-layer equivalent of LOTL)