Blue Kitsune

Blue Kitsune, also known as APT29, Cozy Bear, and the Dukes, is a notable threat actor in the cybersecurity landscape. This entity has been linked to various cyber attacks against government bodies, academia, defense sectors, and non-governmental organizations worldwide, primarily through phishing emails. The group's activities have been tracked since 2015, with their tools and techniques evolving over time to include more sophisticated methods of attack. A key tool associated with Blue Kitsune is the WellMess malware. While it was initially challenging to definitively attribute this backdoor to Blue Kitsune, the National Cyber Security Centre (NCSC) has publicly attributed it to them. The WellMess backdoor shares design similarities with Seaduke, another tool previously used by Blue Kitsune. These correlations provide an interesting insight into the group's modus operandi, although these techniques are not exclusive to them. Despite exposure through open-source reporting, Blue Kitsune has not abandoned the use of the WellMess backdoor. Instead, they have improved its functionality, demonstrating the group's resilience and adaptability. Reports published in collaboration with Canada’s Communications Security Establishment and the US National Security Agency further attribute WellMess to Blue Kitsune, reinforcing the threat this actor poses to global cybersecurity.