Mandiant No Easy Breach

APT29 used UPX to pack files.

APT29 used WMI to steal credentials and execute backdoors at a future time.

APT29 has used named and hijacked scheduled tasks to establish persistence.

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

APT29 has used SDelete to remove artifacts from victim networks.

A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.

APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.

APT29 has downloaded additional tools and malware onto compromised networks.

APT29 has used WMI event subscriptions for persistence.

APT29 used sticky-keys to obtain unauthenticated, privileged console access.

APT29 added Registry Run keys to establish persistence.

APT29 has bypassed UAC.

APT29 used Kerberos ticket attacks for lateral movement.

SeaDuke compressed data with zlib prior to sending it over C2.

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.

SeaDuke C2 traffic has been encrypted with RC4 and AES.

APT29 has used unique malware in many of their operations.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.