The most dangerous nation-state actor on the internet is the one your tools keep waving through. Here's why it never trips a single alarm, and what it actually takes to catch it.
In late 2020, thousands of organisations learned they had been compromised by the same adversary. Government agencies. Fortune 500 companies. Security firms that sell breach prevention for a living.
None of them were broken into.
They were updated into. A group known as APT29, or Cozy Bear, attributed to Russia's SVR foreign intelligence service, had slipped malicious code into a routine SolarWinds software update. Every victim installed it themselves, through the front door, carrying a valid digital signature. By the time anyone noticed, the intruders had been sitting inside some networks for more than a year.
That is the whole problem with APT29 in a single story. It doesn't force its way in. It arrives looking exactly like something you already trust.
Most attackers are in a hurry. They want to encrypt your files, cash out, and leave, and that urgency is often what gives them away.
APT29 is the opposite. Its goal isn't disruption. It's gathering intelligence. It wants to live inside your network for months, reading email, copying documents, and studying how your organisation works, without ever being noticed. Every choice it makes serves one instruction: Don't Stand Out.
Security teams have a name for this style, living off the land. Instead of dropping obvious malware that antivirus might flag, the attacker uses the tools already sitting on your systems: PowerShell, Windows management services, and trusted cloud storage. Its activity dissolves into the ordinary background noise of a working network. There is very little to find because, in a sense, there is very little new to find.
Here is roughly how an APT29 intrusion unfolds, and why each step, taken on its own, is so easy to wave through.
It starts with an email. One employee opens an attachment. A macro runs quietly and launches PowerShell, Windows' built-in scripting tool, with its command scrambled into an unreadable encoded string. To your monitoring, this reads as Office opening a standard Windows utility. That happens on legitimate machines every day.
Then it settles in. Rather than writing a file that antivirus might catch, APT29 hides its foothold inside Windows' own event subscription system, so it survives reboots and leaves almost nothing on disk to discover.
Next it takes your credentials. It reaches into a protected area of Windows memory called LSASS, the process that holds live passwords and login tokens, and copies them. This is the technique behind the well-known tool Mimikatz. Once it has those credentials, the attacker stops behaving like an intruder and starts looking like one of your own users.
From there it moves sideways. Using the stolen credentials, it logs into other machines the way a real administrator would. In one especially quiet move, it can ask a domain controller to hand over every password hash in the organisation, by impersonating another domain controller. This abuse of a normal Windows replication process is called DCSync. This is no exploit. This is no malware. This is just a trusted looking request from a trusted-looking account.
Then it phones home. To receive instructions, the malware beacons. It checks in with the attacker's server at regular intervals. But APT29 doesn't beacon to a suspicious address a firewall would block. It beacons through Dropbox, OneDrive, and Google Drive, services your firewall already trusts. The only tell is rhythm. A person's cloud usage is irregular and human. Malware checks in with machine-like regularity.
Finally it steals the data, slowly. Files are compressed, encrypted, and trickled out through those same trusted cloud connections, kept deliberately below the volume that would trigger a data-loss alert.
Now read that sequence again and notice what's missing. At no point does anything obviously wrong happen. The office ran a script. A process reads some memory. An account logged into a server. Something uploaded to Dropbox. Each of these occurs thousands of times a day inside a healthy enterprise.
That's the trap. Every individual step is innocent. Only the sequence is an attack.
This is exactly where conventional detection struggles, and why so many SOC teams are quietly burning out.
Point tools evaluate events one at a time. Was this login valid? Was this PowerShell command authorised? Was this cloud upload within policy? Judged individually, every APT29 action sits below the threshold that would justify an alert. And on the rare occasion one does fire, it lands in a queue of a few thousand other low-priority alerts, most of which are false.
So the analyst does the rational thing. They glance at "Office launched PowerShell," see it's technically possible for a legitimate macro, and move on. They were right about the single event. They just never got to see it next to the encoded command, the memory read, the odd login, and the metronome-steady Dropbox traffic, because no tool put those five things in the same picture.
When there are more tools, there will be more alerts, and there will be less clarity. Attackers like APT29 don't defeat your controls. They hide in the gaps between them.
You do not catch a group like APT29 on any single moment. You catch it by connecting the many different moments happening simultaneously.
That reframe changes what "detection" even means. Instead of asking is this one event bad?, the question becomes does this pattern, across the whole environment, look like an intrusion in progress? Individually weak signals become a strong one when they line up in the right order, on the right host, within the right window of time.
Concretely, that looks like:
● An Office application spawning encoded PowerShell within 60 seconds, a combination legitimate software effectively never produces.
● A DCSync-style replication request (Windows Event 4662) coming from a machine that is not a domain controller, a request that has no honest reason to exist.
● A process beaconing to cloud storage with less than 15% timing jitter, a regularity no human hand produces.
Each of these on its own is a shrug. Correlated, they are a nation-state actor mid-operation.
This is the specific problem Invinsense SIEM is built to solve. Rather than scoring events in isolation, it watches every stage of the attack chain at once, so each move APT29 makes runs into a detection designed for exactly that move, and the chain gets cut at the earliest link it touches.
Here is how that plays out against the intrusion we just walked through.
Stage 1: The phishing email arrives. Before the attachment ever reaches the employee, it is detonated in a sandbox, an isolated environment where the file is opened safely to see what it actually does. If it behaves maliciously, it never lands in the inbox. And if a lure does slip through and gets opened, the next stage is already covered.
Stage 2: The hidden PowerShell fires. The moment an Office application spawns PowerShell with an encoded command within 60 seconds, the rule fires. There is no legitimate software pattern that looks like this. The SIEM kills the process before the payload downloads, and SOAR, the automation layer that executes response actions without waiting for a human, isolates the endpoint from the network. For APT29, the intrusion usually ends here, minutes after it began.
Stage 3: It tries to settle in. Suppose the attacker gets further and plants its fileless persistence, the WMI event subscription that survives reboots. Creating one requires a specific three-part sequence (a filter, a consumer, and a binding), and that sequence is itself the signature. The correlation engine spots it within five minutes and removes the subscription automatically. The foothold is gone before it has ever been used.
Stage 4: It reaches for your credentials. When any process that isn't a whitelisted security tool tries to read LSASS memory, the store of live passwords and tokens, the SIEM blocks the process on the spot, captures a memory snapshot for forensics, and revokes the active sessions. Stolen credentials are only dangerous if they can be used; revoking the sessions makes them dead on arrival, and Pass-the-Hash never becomes possible.
Stage 5: It goes after the whole domain. If the attacker attempts DCSync, asking a domain controller to replicate every password hash, the request generates Windows Event 4662. The SIEM knows which machines are real domain controllers. A replication request from anything else has no honest explanation, and it is flagged the moment it appears.
Stage 6: It tries to move sideways. Behavioural analytics (UEBA, a baseline of how each user and machine normally behaves) watches for the tells of lateral movement: the same credential appearing on multiple hosts in quick succession, or logins that would require impossible travel. When the pattern appears, the offending session is cut.
Stage 7: It phones home through the cloud. An unexpected process connecting to Dropbox, OneDrive, or Google Drive five or more times in six hours, with less than 15% timing jitter, is a machine on a schedule, not a person doing their job. The outbound connection is blocked and the packets are captured for analysis, severing the attacker's command channel before further instructions arrive.
Stage 8: It starts to steal. Exfiltration has two ingredients: compression of sensitive files, then above-baseline upload volume. The correlation engine watches for both appearing together, throttles the upload, and blocks the session, before the transfer completes, not in the post-incident report.
Stage 9: It tries to erase the evidence. APT29 routinely deletes event logs to cover its tracks. Here the design does the work: logs are already written to immutable backup before any deletion can occur, so nothing is lost, and the deletion attempt itself fires an alert. The cover-up becomes the confession.
And when any critical detection confirms: the account is disabled, active sessions are cut, the endpoint is isolated, and the forensic evidence is packaged, automatically, at 3 a.m. on a Sunday just as reliably as at 3 p.m. on a Tuesday.
Notice the pattern across all nine stages. The defence never depends on catching APT29 at one perfect moment. Every link in the chain has its own tripwire, and the attacker has to evade all of them, in sequence, without ever producing a rhythm, a parent-child process pair, or a replication request that gives the game away.
The economics invert: APT29's greatest strength is patience, and this approach makes every additional day inside the network another day of exposure to nine different ways of being caught.
The value isn't any single rule. It's that the sequence no longer has anywhere to hide.
Any vendor who tells you their platform stops everything is selling you the next breach.
There are parts of APT29's toolkit that correlation handles less confidently today.
Steganography-based command-and-control, hiding instructions inside ordinary-looking images, as the HAMMERTOSS tool does, is hard to distinguish from benign traffic and needs additional tuning.
DNS tunnelling detection sits at medium coverage. And behavioural profiling of the supply chain itself, the vector that made SolarWinds possible, remains one of the genuinely unsolved problems in the industry.
Naming those gaps isn't a weakness. It's the difference between a security posture and a marketing slogan. You defend what you can see clearly, and you stay honest about the edges you're still sharpening.
APT29 will not break your identity system. It will convince it that a request is legitimate. It will not smuggle in exotic malware. It will borrow the tools you already run. It doesn't need to defeat every control you own, it only needs one trusted path that no one is watching end to end.
Which means the real question for your security team isn't "would we block each of these actions?"
It's "would we notice how they connect, before the year is up?"
Discover complete cybersecurity expertise you can trust and prove you made the right choice!
