APT29 Used Domain Fronting, Tor to Execute Backdoor Posted on March 27, 2017 by Simon Steed APT29, a/k/a Cozy Bear, has used Tor and a technique called domain fronting in order to secure backdoor access to targets for nearly two years running.