SVR cyber actors adapt tactics for initial cloud access

This joint advisory from NCSC and international partners attributes ongoing cloud-focused activity to SVR-attributed APT29, describes how the group is evolving its initial-access techniques (password spraying/brute force against service and dormant accounts, stolen access tokens, MFA "bombing", device enrolment, and residential proxies), maps these behaviours to MITRE ATT&CK, and provides detection and mitigation guidance for organisations that have moved to cloud infrastructure.