039| Deconstructing the Dukes: A Researcher's Retrospective of APT29

<p>APT29, aka Cozy Bear or the Dukes, is a cyber espionage group whose misdeeds include famously hacking into the DNC servers in the run-up to the 2016 US election. Now, as the subject of MITRE's latest ATT&CK Evaluation, the group is in focus again. The Dukes are familiar to F-Secure's <a href= "https://twitter.com/lehtior2?lang=en" target="_blank" rel= "noopener">Artturi Lehtio</a>, who extensively researched them in 2015. But hindsight is 20/20, and Artturi joins the show to discuss how his views on the group have changed since his research. </p> <p>Also in this episode: How APT groups behave after being burned and why the Dukes are different; why calling them a single organization is too strong; and why published APT research has generally dwindled in recent years.</p> <p><strong>Links:</strong></p> <p><a href="https://blog.f-secure.com/podcast-dukes-apt29/" target= "_blank" rel="noopener">Episode 39 transcript</a></p> <p><a href= "https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf" target="_blank" rel="noopener">The Dukes: 7 Years of Russian Cyberespionage - F-Secure whitepaper</a></p> <p><a href="https://attackevals.mitre.org/APT29/" target="_blank" rel="noopener">MITRE ATT&CK Evaluation: APT29</a></p> <p><a href= "https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/" target="_blank" rel="noopener">Operation Ghost - ESET</a></p> <p><a href= "https://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016" target="_blank" rel="noopener">No Easy Breach by Matthew Dunwoody & Nick Carr - DerbyCon 2016</a></p> <p><a href= "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/" target="_blank" rel="noopener">Dukes activity after their "return" in 2016 - Volexity</a></p>