NOBELIUM

Threat Actor updated a month ago (2024-11-29T14:33:05.068Z)

Download STIX

Preview STIX

Nobelium, a Russia-linked Advanced Persistent Threat (APT) group also known as APT29, SVR Group, BlueBravo, Cozy Bear, Midnight Blizzard, and The Dukes, has been identified as a significant cybersecurity threat. In 2024, Nobelium targeted French diplomatic entities, posing a major concern to the international community. Furthermore, there were concerns raised about potential connections between Nobelium and another threat actor, BlackBasta, with suspicions of collaboration on high-profile attacks against healthcare institutions. The group's activities have been extensive and widespread, with Microsoft warning of a large-scale spear-phishing campaign by Nobelium targeting over 1,000 users across more than 100 organizations for intelligence gathering. Additionally, the APT group has targeted vulnerable servers, such as Zimbra and JetBrains TeamCity, as part of a mass scale campaign. This activity led U.S. and U.K. cyber agencies to issue warnings about the ongoing cyber espionage efforts of the group. Google's Threat Analysis Group has observed Nobelium's activities, further confirming its threat status. In November 2023, the group used a "password spray attack" to breach a Microsoft platform, demonstrating their capabilities and intent. Previous activities of the group include intelligence gathering operations against several European Union governments supporting Ukraine in the ongoing war, as reported in May 2023. Despite the variety of names used to refer to this group, it is clear that Nobelium remains a persistent and evolving threat in the cybersecurity landscape.

Description last updated: 2024-11-28T11:51:49.770Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
APT29 is a possible alias for NOBELIUM. APT29, also known as Midnight Blizzard and linked to Russia's Foreign Intelligence Service (SVR), is a notorious threat actor that has been implicated in several high-profile cyberattacks. The group has demonstrated sophisticated capabilities, exploiting vulnerabilities such as the WinRAR 0day flaw	6
Midnight Blizzard is a possible alias for NOBELIUM. Midnight Blizzard, also known as APT29 or Cozy Bear, is a Russia-linked threat actor associated with the country's Foreign Intelligence Service (SVR). Throughout 2024, the group has been implicated in several high-profile cyber-attacks, targeting global organizations and demonstrating sophisticated	6
Cozy Bear is a possible alias for NOBELIUM. Cozy Bear, also known as APT29 and Midnight Blizzard, is a threat actor believed to be linked to the Russian government. This entity has been behind numerous cyberattacks with malicious intent, targeting various organizations and systems worldwide. The first significant intrusion attributed to Cozy	5
The Dukes is a possible alias for NOBELIUM. The Dukes, also known as APT29, Cozy Bear, Midnight Blizzard, Nobelium, and BlueBravo, is a threat actor associated with the Russian government. The group has been active since at least 2008 and has targeted various governments, think tanks, diplomatic entities, and political parties. Notably, in Se	4
Bluebravo is a possible alias for NOBELIUM. BlueBravo, a threat actor linked to the Russia-based Advanced Persistent Threat (APT) group APT29, has been identified as a significant cyber threat. Also known by various other names such as SVR Group, Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes, this entity is suspected of conducting sev	3
Darkhalo is a possible alias for NOBELIUM. DarkHalo, also known as APT29, Cozy Bear, and tracked by Microsoft as Midnight Blizzard (previously NOBELIUM), is a sophisticated threat actor suspected of executing actions with malicious intent. These actions typically involve cyber attacks and are often attributed to either individual hackers, pr	2
Cloaked Ursa is a possible alias for NOBELIUM. Cloaked Ursa, also known as APT29, BlueBravo, Midnight Blizzard, and formerly Nobelium, is a Russian threat actor believed to be associated with Russia's Foreign Intelligence Service (SVR). The group has been active in conducting cyber-espionage attacks against various diplomatic entities throughout	2
UNC2452 is a possible alias for NOBELIUM. UNC2452, also known as Midnight Blizzard, Cozy Bear, APT29, and Nobelium, is a sophisticated threat actor responsible for several high-profile cyber attacks. The group gained notoriety in December 2020 when it compromised SolarWinds' supply chain, an event tracked by Mandiant, a leading cybersecurit	2
YTTRIUM is a possible alias for NOBELIUM. Yttrium, also known as APT29, CozyBear, UNC2452, NOBELIUM, and Midnight Blizzard, is a prominent threat actor in the cybersecurity landscape. This group has been attributed to several significant cyber-attacks, with its activities largely overlapping with those attributed to APT29 or CozyBear, accor	2
Cozybear is a possible alias for NOBELIUM. CozyBear, also known as APT29 and Midnight Blizzard, is a threat actor believed to be linked to the Russian state. This group has been actively engaged in cyber operations against Ukraine and its allies and has been involved in several major breaches, including attacks on Okta, Dropbox, Department o	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Apt

Malware

Microsoft

Phishing

Teamcity

Russia

State Sponso...

Implant

Email Accounts

russian

Blizzard

Backdoor

Source

Exploit

Ukraine

Espionage

France

Azure

Vulnerability

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The EnvyScout Malware is associated with NOBELIUM. EnvyScout is a sophisticated malware used primarily by the threat actor group NOBELIUM, also known as APT29 or Cozy Bear. This malware, tracked by Microsoft and alternatively referred to as Rootsaw, is delivered via spear-phishing emails, often disguised with seemingly harmless attachments such as t	Unspecified	4
The SUNBURST Malware is associated with NOBELIUM. Sunburst is a sophisticated malware that was detected in a major supply chain attack in December 2020. The Sunburst backdoor has been tied to Kazuar, another malicious software, due to code resemblance, indicating its high level of complexity. This malware infiltrates systems, often without the user	Unspecified	3
The FoggyWeb Malware is associated with NOBELIUM. FoggyWeb is a type of malware recently discovered by Microsoft that hackers are using to remotely steal network admin credentials. The malware, which has been in use since as early as April 2021, is employed by the hacker group NOBELIUM to remotely exfiltrate the configuration database of compromise	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The APT28 Threat Actor is associated with NOBELIUM. APT28, also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, and STRONTIUM, is a threat actor linked to Russia. The group has been associated with cyber espionage campaigns across Central Asia and has historically targeted areas of national security, military operations, and geopolitical influ	Unspecified	2

Source Document References

Information about the NOBELIUM Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securityaffairs	6 days ago	APT29 group used red team tools in rogue RDP attacks
DARKReading	a month ago	BlackBasta Ransomware Brand Picks Up Where Conti Left Off
Securityaffairs	2 months ago	Russia-linked Midnight Blizzard APT targeted 100+ organizations with a spear-phishing campaign using RDP files
Securityaffairs	2 months ago	Russia-linked group APT29 is targeting Zimbra and JetBrains TeamCity servers on a large scale
InfoSecurity-magazine	3 months ago	Russia's SVR Targets Zimbra, TeamCity Servers for Cyber Espionage
Securityaffairs	4 months ago	Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa
Securityaffairs	4 months ago	SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 6
Securityaffairs	5 months ago	security-affairs-malware-newsletter-round-5
CERT-EU	a year ago	Microsoft hack: Company says Russian group broke into its email system using a password ‘spray attack’ \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker
CERT-EU	10 months ago	Response to CISA Advisory (AA24-057A): SVR Cyber Actors Adapt Tactics for Initial Cloud Access
CERT-EU	10 months ago	Microsoft says Russian hacking group is still trying to crack its systems \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker
BankInfoSecurity	6 months ago	Russian State Hackers Target French Government for Espionage
Securityaffairs	5 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	5 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	5 months ago	Security Affairs Malware Newsletter - Round 2
Securityaffairs	6 months ago	Security Affairs Malware Newsletter - Round 1
Securityaffairs	6 months ago	Russia-linked group APT29 likely breached TeamViewer
Securityaffairs	6 months ago	Russia's Midnight Blizzard stole email of more Microsoft customers
Securityaffairs	6 months ago	Security Affairs newsletter Round 478 by Pierluigi Paganini – INTERNATIONAL EDITION
Checkpoint	6 months ago	24th June – Threat Intelligence Report - Check Point Research