NOBELIUM

Threat Actor updated 14 days ago (2024-10-11T15:01:12.861Z)

Download STIX

Preview STIX

Nobelium, a threat actor linked to Russia, has been identified as a significant cybersecurity concern due to its persistent and sophisticated cyber-espionage campaigns. Known also by various other names such as APT29, Cozy Bear, Midnight Blizzard, and The Dukes, Nobelium is believed to be operating on behalf of the Russian Foreign Intelligence Service (SVR). Active since at least 2013, this group shares many similarities in Tactics, Techniques, and Procedures (TTP) with its historical adversary APT29. Microsoft first identified Nobelium as a new iteration of APT29 in March 2021, but multiple security vendors continue to use the two terms interchangeably. Recently, Nobelium has targeted French diplomatic entities, reflecting its political motivations and state-sponsored nature. In a joint advisory published on October 10, US and UK government agencies warned of an ongoing cyber espionage campaign by the group. Previous activities reported on May 4, 2023, revealed that Nobelium focused its efforts on gathering intelligence on European Union governments supporting Ukraine in the ongoing war. The group has also demonstrated its ability to breach major tech platforms. In November 2023, using a "password spray attack," Nobelium infiltrated a Microsoft platform. This technique involves using the same password across multiple accounts to gain unauthorized access. Furthermore, Microsoft reported attempts by Nobelium, referred to internally as Midnight Blizzard, to access its internal systems and source code repositories. These incidents underscore the advanced capabilities of Nobelium and the serious threat it poses to global cybersecurity.

Description last updated: 2024-10-11T14:16:33.006Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
APT29 is a possible alias for NOBELIUM. APT29, also known as Cozy Bear, Midnight Blizzard, Nobelium, and the Dukes, is a Russia-linked threat actor associated with SVR. This group is notorious for its sophisticated cyber espionage tactics, techniques, and procedures. APT29 often uses The Onion Router (TOR) network, leased and compromised	6
Midnight Blizzard is a possible alias for NOBELIUM. Midnight Blizzard, a Russia-linked Advanced Persistent Threat (APT) group also known as APT29, Cozy Bear, Nobelium, and The Dukes, has been actively involved in large-scale cyberespionage campaigns targeting organizations worldwide. This threat actor has demonstrated sophisticated capabilities to br	6
Cozy Bear is a possible alias for NOBELIUM. Cozy Bear, also known as APT29 and associated with names like Midnight Blizzard, Nobelium, and The Dukes, is a threat actor believed to be linked with the Russian state. This group has been involved in numerous cyber espionage activities, demonstrating proficiency across multiple operating systems a	5
The Dukes is a possible alias for NOBELIUM. The Dukes, also known as APT29, Cozy Bear, Midnight Blizzard, and Nobelium, is a threat actor associated with the Russian government that has been active since at least 2008. Notably, this group was implicated in the 2015 attack on the American Democratic National Committee (DNC). The FBI alerted th	4
Bluebravo is a possible alias for NOBELIUM. BlueBravo, also known as APT29, Nobelium, Cozy Bear, Midnight Blizzard, and The Dukes, is a threat actor group linked to Russia that has been implicated in multiple high-profile cyberattacks. Recently, TeamViewer discovered a breach in its corporate network, with reports attributing the intrusion to	3
Darkhalo is a possible alias for NOBELIUM. DarkHalo, also known as APT29, Cozy Bear, and tracked by Microsoft as Midnight Blizzard (previously NOBELIUM), is a sophisticated threat actor suspected of executing actions with malicious intent. These actions typically involve cyber attacks and are often attributed to either individual hackers, pr	2
Cloaked Ursa is a possible alias for NOBELIUM. Cloaked Ursa, also known as APT29, BlueBravo, Midnight Blizzard, and formerly Nobelium, is a Russian threat actor believed to be associated with Russia's Foreign Intelligence Service (SVR). The group has been active in conducting cyber-espionage attacks against various diplomatic entities throughout	2
UNC2452 is a possible alias for NOBELIUM. UNC2452, also known as APT29, Cozy Bear, Nobelium, and Midnight Blizzard, is a highly skilled and disciplined threat actor group linked to Russia's SVR intelligence agency. The group gained notoriety for its role in the SolarWinds compromise in December 2020, an extensive cyberattack that involved a	2
YTTRIUM is a possible alias for NOBELIUM. Yttrium, also known as APT29, CozyBear, UNC2452, NOBELIUM, and Midnight Blizzard, is a prominent threat actor in the cybersecurity landscape. This group has been attributed to several significant cyber-attacks, with its activities largely overlapping with those attributed to APT29 or CozyBear, accor	2
Cozybear is a possible alias for NOBELIUM. CozyBear, also known as APT29 and Midnight Blizzard, is a threat actor believed to be linked to the Russian state. This group has been actively engaged in cyber operations against Ukraine and its allies and has been involved in several major breaches, including attacks on Okta, Dropbox, Department o	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Phishing

Apt

Malware

Microsoft

Teamcity

State Sponso...

Implant

Email Accounts

russian

Russia

Blizzard

Backdoor

Source

Exploit

Ukraine

Espionage

France

Azure

Vulnerability

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The EnvyScout Malware is associated with NOBELIUM. EnvyScout is a sophisticated malware used primarily by the threat actor group NOBELIUM, also known as APT29 or Cozy Bear. This malware, tracked by Microsoft and alternatively referred to as Rootsaw, is delivered via spear-phishing emails, often disguised with seemingly harmless attachments such as t	Unspecified	4
The SUNBURST Malware is associated with NOBELIUM. Sunburst is a sophisticated malware that was detected in a major supply chain attack in December 2020. The Sunburst backdoor has been tied to Kazuar, another malicious software, due to code resemblance, indicating its high level of complexity. This malware infiltrates systems, often without the user	Unspecified	3
The FoggyWeb Malware is associated with NOBELIUM. FoggyWeb is a type of malware recently discovered by Microsoft that hackers are using to remotely steal network admin credentials. The malware, which has been in use since as early as April 2021, is employed by the hacker group NOBELIUM to remotely exfiltrate the configuration database of compromise	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The APT28 Threat Actor is associated with NOBELIUM. APT28, also known as Fancy Bear, Forest Blizzard, and Unit 26165 of the Russian Main Intelligence Directorate, is a Russia-linked threat actor that has been active since at least 2007. This group has targeted governments, militaries, and security organizations worldwide with a particular focus on th	Unspecified	2

Source Document References

Information about the NOBELIUM Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securityaffairs	13 days ago	Russia-linked group APT29 is targeting Zimbra and JetBrains TeamCity servers on a large scale
InfoSecurity-magazine	14 days ago	Russia's SVR Targets Zimbra, TeamCity Servers for Cyber Espionage
Securityaffairs	2 months ago	Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa
Securityaffairs	2 months ago	SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 6
Securityaffairs	3 months ago	security-affairs-malware-newsletter-round-5
CERT-EU	9 months ago	Microsoft hack: Company says Russian group broke into its email system using a password ‘spray attack’ \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker
CERT-EU	8 months ago	Response to CISA Advisory (AA24-057A): SVR Cyber Actors Adapt Tactics for Initial Cloud Access
CERT-EU	8 months ago	Microsoft says Russian hacking group is still trying to crack its systems \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker
BankInfoSecurity	4 months ago	Russian State Hackers Target French Government for Espionage
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 2
Securityaffairs	4 months ago	Security Affairs Malware Newsletter - Round 1
Securityaffairs	4 months ago	Russia-linked group APT29 likely breached TeamViewer
Securityaffairs	4 months ago	Russia's Midnight Blizzard stole email of more Microsoft customers
Securityaffairs	4 months ago	Security Affairs newsletter Round 478 by Pierluigi Paganini – INTERNATIONAL EDITION
Checkpoint	4 months ago	24th June – Threat Intelligence Report - Check Point Research
Securityaffairs	4 months ago	Security Affairs newsletter Round 477 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	Russia-linked APT Nobelium targets French diplomatic entities
DARKReading	4 months ago	Russia's Midnight Blizzard Seeks to Snow French Diplomats