Advisory Further TTPs associated with SVR cyber actors.pdf

This NCSC-led advisory details Tactics, Techniques and Procedures (TTPs) associated with SVR (APT29), describing widespread exploitation of publicly disclosed CVEs (including Exchange vulnerabilities), supply-chain compromises (SolarWinds, Mimecast), use of offensive frameworks (Sliver, Cobalt Strike) and custom malware (GoldFinder, GoldMax, Sibot), and provides detection signatures (Snort, YARA) and mitigation guidance for defenders.