Cozy Bear

Cozy Bear, also known as APT29, Midnight Blizzard, and Nobelium, is a threat actor believed to operate out of Russia's Foreign Intelligence Service or SVR. This group has been linked to several high-profile cyber intrusions. One of the earliest identified activities of Cozy Bear was at the Democratic National Committee (DNC), where its intrusion was traced back to the summer of 2015. The group was separately active from another threat actor, Fancy Bear, which breached the DNC network in April 2016. Following this, the Russian entity established the Guccifer 2.0 persona, possibly as a means to release data from attacks attributed to both Fancy Bear and Cozy Bear. Cozy Bear's activities have continued unabated, with the StellarParticle campaign against multiple organizations being a notable example. In this campaign, the group used novel tools and techniques to achieve their objectives, as identified by CrowdStrike incident responders and the CrowdStrike Intelligence team. Furthermore, Google TAG researchers observed the activities of this Russia-linked group. Recently, TeamViewer discovered a breach in its corporate network, with some reports attributing the intrusion to Cozy Bear. The group's activities are not limited to these instances. Despite the French agency ANSSI differentiating these groups into separate threat clusters, including a group named Dark Halo, which was responsible for the 2020 SolarWinds attack, Cozy Bear has been linked to these attacks. Additionally, there is circumstantial evidence linking the group to the Brutus campaign, based on IP addresses previously seen in attacks attributed to Cozy Bear. The group continues to be one of the top cloud adversaries, posing significant cybersecurity threats globally.