apt29-cozy-bear - Emulate APT29’s cloud-centric espionage TTPs
Maps APT29’s ATT&CK techniques to Decepticon emulation tooling for authorized red-team exercises.
Tags
Updated: 2026-10-06Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Emulate APT29 TTPs
- Map TTPs to Decepticon tooling
- Exercise blue-cell defenses
Inputs
- Authorized red-team scope
- Target environment
- ATT&CK technique selection
- Decepticon emulation tooling
Outputs
- ATT&CK-mapped emulation actions
- Emulated adversary activity
- Blue-cell exercise activity
Requirements
- Bash tool access
- Read tool access
- Write tool access
- Authorized red-team context
- Decepticon emulation tooling