Five Eyes Agencies Expose APT29's Evolving Cloud Attack Tactics

**APT29 (Cozy Bear)** — Five Eyes agencies warn that the SVR‑aligned threat actor has shifted to cloud‑centric intrusion methods, using brute‑force and password‑spraying against service/dormant accounts, token theft, credential reuse and prompt‑bombing to bypass MFA, and residential proxies to mask origin; the actor continues to target organizations (including Microsoft and HPE) and can deploy advanced post‑compromise tools such as MagicWeb.