Cozy Bear

Cozy Bear, also known as APT29 and associated with names like Midnight Blizzard, Nobelium, and The Dukes, is a threat actor believed to be linked with the Russian state. This group has been involved in numerous cyber espionage activities, demonstrating proficiency across multiple operating systems and security platforms. Cozy Bear's intrusion into the Democratic National Committee (DNC) network dates back to the summer of 2015, a separate event from the Fancy Bear breach that occurred in April 2016. The group has displayed its ability to navigate and compromise major cloud service providers, often targeting Azure services for data theft. The StellarParticle campaign is another significant operation associated with Cozy Bear, where they used novel tools and techniques to infiltrate multiple organizations. This activity was identified by CrowdStrike incident responders and their Intelligence team. Post identification, Russia established the Guccifer 2.0 persona to release data from attacks attributed to Fancy Bear, Cozy Bear, or other Russian Advanced Persistent Threats (APTs). Furthermore, Cozy Bear's activities have prompted warnings from government agencies in the US and the UK about ongoing cyber espionage campaigns. More recently, TeamViewer discovered a breach in its corporate network, which some reports attribute to Cozy Bear. Despite differentiating these groups into separate threat clusters, the French agency ANSSI has linked the group to the cyberespionage group Nobelium, responsible for the 2020 SolarWinds attack. There are also indications of Cozy Bear's involvement in the Brutus operations based on circumstantial evidence related to IP addresses previously seen in their attacks.