# SVR APT29 targets U.S. government and cloud infrastructure

Published: 2025-06-20 · Severity: high · Sectors: government-national, defense, technology, healthcare, energy
Canonical: https://vorant.io/reports/574ed111-c3c7-5285-8f63-fb258a7a1921/svr-apt29-targets-u-s-government-and-cloud-infrastructure

> CISA reports SVR cyber operations targeting government, think tanks, and IT firms via password spraying, zero-days, and SolarWinds compromise.

The FBI, DHS, and CISA assess that Russian Foreign Intelligence Service (SVR) cyber actors—tracked as APT29, the Dukes, CozyBear, and Yttrium—pose a longstanding threat to U.S. and allied entities. Since 2018, the SVR has shifted from malware-focused operations to targeting cloud resources, particularly email and Microsoft 365 environments. The group exploits initial access through password spraying, unpatched VPN appliances, and supply-chain compromises like the SolarWinds incident, using stealthy tradecraft to move laterally within networks and access high-value targets such as IT staff accounts and vaccine research repositories.

SVR operational tradecraft includes low-and-slow password spraying from geographically distributed IP addresses (residential, commercial, mobile, and Tor), leveraging misconfigured multi-factor authentication exemptions and legacy authentication protocols. The group uses leased VPS infrastructure obtained via false identities and cryptocurrency, registers malicious infrastructure on cock.li email services, and employs open-source tools like Mimikatz and Cobalt Strike. Following initial compromise, actors establish persistent access by modifying email permissions, targeting administrative accounts, and maintaining access from dedicated infrastructure located in the victim's country to blend with normal traffic patterns.

Defenders should enforce mandatory MFA for all users, restrict remote administrative access, audit cloud configurations and permission changes, monitor for encoded PowerShell and lateral movement, and segment networks using zero-trust architectures. The SolarWinds compromise remains the most visible recent attack vector affecting government agencies and critical infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2019-19781 (KEV)
- Threat actors: Russian Foreign Intelligence Service (SVR)
- Malware: WellMess
- Campaigns: SolarWinds supply-chain compromise

## Detection guidance (public sample)

### Exchange Online Mailbox Delegate or Folder Permission Added

ATT&CK: T1098.002

Detects grants of mailbox or folder permissions in Exchange Online audit logs, which APT29 used to persist by adding email delegates. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange Online Mailbox Delegate or Folder Permission Added
description: Detects Exchange Online audit events that add mailbox, folder or recipient
  permissions. APT29 modified email permissions to keep access to mailboxes. Review
  the acting account and the target mailbox, especially when the actor is an admin
  account that does not normally manage delegation.
tags:
- attack.persistence
- attack.t1098.002
logsource:
  product: m365
  service: audit
detection:
  selection:
    eventSource: Exchange
    eventName:
    - Add-MailboxPermission
    - Add-MailboxFolderPermission
    - Add-RecipientPermission
    - Set-MailboxFolderPermission
  condition: selection
falsepositives:
- Helpdesk or messaging admins granting shared mailbox or delegate access through
  approved tickets
- Onboarding and offboarding automation that assigns mailbox permissions
level: medium
id: be430293-4c2c-5a24-bef1-7edd62df3fe1
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
```

### Cobalt Strike or Mimikatz Default Named Pipe Created

ATT&CK: T1003.001

Detects creation of named pipes associated with Cobalt Strike and Mimikatz, both tools named in the APT29 report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike or Mimikatz Default Named Pipe Created
description: Detects named pipe creation matching default Cobalt Strike (WkSvcPipeMgr,
  MSSE-*-server, hashdump, numeric default pipes) and Mimikatz pipe names. The report
  names both tools as used by SVR actors for credential theft and lateral movement.
tags:
- attack.credential-access
- attack.t1003.001
- attack.lateral-movement
logsource:
  category: pipe_created
  product: windows
detection:
  selection_cs:
    PipeName|startswith:
    - \WkSvcPipeMgr_
    - \hashdump
    PipeName:
    - \MSSE-*-server
    - \334485
    - \461092
  selection_mimikatz:
    PipeName|contains: mimikatz
  condition: 1 of selection_*
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike or Mimikatz profiles
- Security tooling that names a test pipe after mimikatz
level: high
id: b186e5ba-236e-534c-aa30-6bbb6386e315
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
```

### Encoded PowerShell Command Line Execution

ATT&CK: T1059.001

Detects PowerShell launched with an encoded command argument, which the report advises defenders to monitor. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Encoded PowerShell Command Line Execution
description: Detects powershell.exe or pwsh.exe started with an -EncodedCommand style
  argument, which the advisory recommends monitoring. Best used with context such
  as an unusual parent process, user or host, because management tools also use encoded
  commands.
tags:
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_enc:
    CommandLine|contains|windash:
    - ' -enc '
    - ' -encodedcommand '
    - ' -ec '
  filter_mgmt:
    ParentImage|endswith:
    - \ccmexec.exe
    - \CcmExec.exe
    - \IntuneManagementExtension.exe
  condition: selection_img and selection_enc and not filter_mgmt
falsepositives:
- SCCM, Intune or other endpoint management agents deploying scripts as encoded commands
- Administrator scripts and installers that wrap PowerShell in -EncodedCommand
level: medium
id: c1da27f3-3660-5a34-bfdc-e246e9a1724d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/574ed111-c3c7-5285-8f63-fb258a7a1921/svr-apt29-targets-u-s-government-and-cloud-infrastructure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup