Cozybear

CozyBear, also known as APT29 and Midnight Blizzard, is a threat actor believed to be linked to the Russian state. This group has been actively engaged in cyber operations against Ukraine and its allies and has been involved in several major breaches, including attacks on Okta, Dropbox, Department of Defense, Uber, Lastpass, Log4j, Codecov, Cozybear, and GeneralBytes. The cybersecurity industry recognizes this group under various names due to differing naming conventions, with Microsoft referring to it as YTTRIUM or Midnight Blizzard, formerly Nobelium. In a significant incident, CozyBear breached senior Microsoft executives' email inboxes using an unsophisticated hacking technique. Microsoft emphasized that the hackers had targeted only "a very small percentage of Microsoft corporate email accounts" with the aim of collecting "information related to Midnight Blizzard itself." Despite the limited scope, this breach sparked major security concerns due to the high-profile nature of the targets and the potential for sensitive information exposure. Third-party security researchers attribute these cyber-attacks to CozyBear, emphasizing the overlap between the activities of this group and those tracked by Microsoft as YTTRIUM. The regulatory filing indicates that the hackers are believed to be "Midnight Blizzard," further reinforcing the connection between these different identifiers. As of 2023, the Cloud Security Alliance (CSA) identified the involvement of CozyBear in major breaches, highlighting the continuing threat posed by this group.