SVR cyber actors adapt tactics for initial cloud access

As organisations continue to modernise their systems and move to cloud-based infrastructure, APT29 has adapted its methods to this environment. This advisory provides an overview of the TTPs used by the group to gain initial access into the cloud systems, along with advice to detect and mitigate this activity.

The NCSC-UK and international partners assess that APT29 is a cyber espionage group almost certainly linked to the SVR, part of the Russian intelligence services. This attribution, and the details provided in this advisory attribution, are supported by the:

• US National Security Agency (NSA),
• US Cybersecurity and Infrastructure Security Agency (CISA),
• US Cyber National Mission Force (CNMF),
• Federal Bureau of Investigation (FBI),
• Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC),
• Canadian Centre for Cyber Security (CCCS), and
• New Zealand National Cyber Security Centre (NCSC-NZ)

The advisory details the group’s techniques for targeting cloud environments. Organisations should review the TTPs outlined in the advisory to assess whether their cloud infrastructure may have been targeted or accessed. 

The NCSC recommends that organisations read the report and follow the mitigation advice provided to help protect their networks.