Bluebravo

BlueBravo, also known as APT29, Nobelium, Cozy Bear, Midnight Blizzard, and The Dukes, is a threat actor group linked to Russia that has been implicated in multiple high-profile cyberattacks. Recently, TeamViewer discovered a breach in its corporate network, with reports attributing the intrusion to this group. Earlier in the year, Recorded Future revealed that BlueBravo was using the productivity and collaboration service Notion as part of its operations, demonstrating its ability to manipulate legitimate services for malicious purposes. The group's activities have escalated with a mass scale campaign targeting vulnerable Zimbra and JetBrains TeamCity servers, as warned by U.S. and U.K. cyber agencies. Despite these attacks being linked to Nobelium by the French agency ANSSI, they differentiate these groups into separate threat clusters, including Dark Halo, which was responsible for the 2020 SolarWinds attack. Furthermore, the group Midnight Blizzard, along with APT28, was involved in the Democratic National Committee hack and subsequent attacks aimed at the 2016 US Presidential Elections, including the SolarWinds supply chain attack that impacted more than 18,000 customer organizations, including Microsoft. In response to these threats, Red Teams can use information about how BlueBravo targets Windows Management Instrumentation (WMI) and PowerShell to inform their next threat hunt. An IP Intelligence Card™ has highlighted a known command and control (C2) server associated with BlueBravo. A joint advisory issued by cybersecurity agencies of Five Eyes (US, UK, Australia, Canada, and New Zealand) warns that the Russia-linked APT29 threat actors have switched to targeting cloud services, indicating a shift in their strategy and underscoring the necessity for heightened security measures in cloud computing environments.