# Apt29 Cozy Bear

Adversary-emulation profile for APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM / The...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt29-cozy-bear -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt29-cozy-bear -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt29-cozy-bear -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt29-cozy-bear -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM / The Dukes), Russia's SVR-attributed cyber-espionage group, mapping its ATT&CK TTPs to Decepticon emulation tooling.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT29 (Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes), Adversary Emulation Profile

APT29 (MITRE ATT&CK **G0016**; also tracked as Cozy Bear, Midnight Blizzard, NOBELIUM, The Dukes, CozyDuke, UNC2452, Dark Halo, NobleBaron, YTTRIUM, Blue Kitsune, IRON RITUAL/IRON HEMLOCK) is a Russian state-sponsored cyber-espionage group attributed by multiple governments to Russia's Foreign Intelligence Service (SVR). Active since at least 2008, it is among the most operationally disciplined intrusion sets on record: it favors patient, stealthy, long-dwell access against high-value strategic targets, custom and living-off-the-land tooling, rigorous operational security (residential-proxy infrastructure, anti-forensic indicator removal, low-and-slow authentication attacks), and a sustained pivot toward cloud and identity-plane attacks (Microsoft 365 / Entra ID, OAuth, federation). It is best known for the 2015, 2016 DNC intrusion, the 2020 SolarWinds Orion supply-chain compromise, and the 2024 Microsoft corporate-email breach. This profile teaches Decepticon to emulate APT29's signature TTPs so an authorized red team can exercise the blue cell against a realistic, identity-and-cloud-centric espionage adversary.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt29-cozy-bear/SKILL.md