**Patience:** APT29 campaigns operate over months or years. Initial access may occur weeks before any post-exploitation activity. - **Operational Security:** Extensive use of compromised infrastructure for C2, encrypted communications, timestomping, and log clearing. Avoidance of commodity malware i