Arsenal attributed to APT29.
Following MITRE ATT&CK Flow methodology.
| CVE | Year | Description |
|---|---|---|
| CVE-2020-4006 | 2020 | VMware Workspace ONE RCE for initial access in parallel campaigns |
| CVE-2021-21972 | 2021 | VMware vCenter RCE exploited for lateral movement |
| CVE-2021-34527 | 2021 | PrintNightmare — used alongside SUNBURST for privilege escalation |
| CVE-2023-42793 | 2023 | JetBrains TeamCity RCE exploited for supply chain access |
| CVE-2019-19781 | 2019 | Citrix ADC RCE used for initial access |
| CVE-2018-13379 | 2018 | Fortinet VPN path traversal for credential theft |
Documented in MITRE ATT&CK, vendor intelligence, and government advisories.
Mitigations with MITRE ATT&CK IDs. Click badges for implementation guidance.
| Plan | Source | Type | Description | Link |
|---|---|---|---|---|
| MITRE CTID - APT29 Full Emulation Plan | MITRE CTID | Open Source | Two-day emulation plan with Day 1 (rapid) and Day 2 (methodical) scenarios | Open |
| MITRE Attack Arsenal - APT29 Caldera DIY | MITRE | Open Source | Caldera abilities, adversary profiles, and emulation plan PDF for APT29 | Open |
| ATT&CK Evaluations Library - APT29 | MITRE Engenuity | Framework | Official ATT&CK Evaluation emulation plan and detection analytics | Open |
| VMware Invoke-APT29 PowerShell Script | VMware Carbon Black TAU | Open Source | PowerShell script simulating APT29 TTPs from MITRE ATT&CK evaluation | Open |
| AttackIQ - CISA AA24-057A SVR Cloud Access | AttackIQ | Commercial | Emulation of SVR cloud access TTPs from CISA advisory | Open |
| Mandiant SUNBURST Countermeasures | Mandiant | Open Source | Detection rules, IOCs, and YARA rules for SolarWinds/SUNBURST | Open |
| APT29 Adversary Simulation (S3N4T0R) | GitHub / S3N4T0R | Open Source | Full attack simulation targeting diplomatic missions with APT29 tradecraft | Open |
| APT29 Emulation Plan PDF | MITRE | Open Source | Detailed 2-day emulation plan document with Day 1 (rapid) and Day 2 (methodical) operations | Open |
| Adversary Emulation Framework (APT29 Playbook) | GitHub / Aviral2642 | Open Source | Python-based framework with APT29 playbook supporting real and safe execution modes | Open |
| Purple Teaming with CALDERA - APT29 | Medium / InderveerSingh | Blog Post | Hands-on walkthrough: Invoke-APT29 PowerShell emulation with CALDERA and ELK detection | Open |
| VMware Invoke-APT29 Blog Post | VMware Security Blog | Blog Post | How to use Invoke-APT29 PowerShell module to simulate techniques from MITRE ATT&CK evaluation | Open |
| mnemonic: Detecting Advanced Threats with Purple Team | mnemonic | Blog Post | Advanced purple team testing methodology emulating APT29-style multi-stage operations with BOFs | Open |
| Emulating APT29 with AttackIQ | AttackIQ | Blog Post | Full attack chain emulation of APT29 with assessment templates and validation scenarios | Open |
| Emulating the Russian Adversary Nobelium/APT29 | AttackIQ | Blog Post | Emulation of APT29 EU government targeting campaign with intelligence-gathering TTPs | Open |