The Dukes

The Dukes, also known as APT29, Cozy Bear, Midnight Blizzard, Nobelium, and BlueBravo, is a threat actor associated with the Russian government. The group has been active since at least 2008 and has targeted various governments, think tanks, diplomatic entities, and political parties. Notably, in September 2015, the FBI alerted the DNC's IT director about suspicious activity linked to the Dukes. Despite repeated warnings from the FBI in October, November, and December of 2015, the Dukes continued their nefarious activities. They launched several waves of highly targeted spear-phishing attacks against U.S.-based think tanks and NGOs in August 2016. Post-election attacks launched by the Dukes on November 9 were similar to previous attacks seen in both 2015 and 2016. In addition to these activities, the Dukes have been involved in significant cybersecurity incidents. They were associated with the StellarParticle campaign, which was related to the SUNSPOT implant from the SolarWinds intrusion in December 2020. More recently, they have been involved in large-scale spear-phishing campaigns targeting over 1,000 users across more than 100 organizations for intelligence gathering. This includes an attack on TeamViewer's corporate network. Furthermore, the Dukes have targeted vulnerable Zimbra and JetBrains TeamCity servers as part of a mass scale campaign, as warned by U.S. and U.K. cyber agencies. Despite the various aliases, all these groups are considered part of the same threat cluster due to their shared tactics, techniques, and procedures (TTPs). However, some organizations, such as the French agency ANSSI, differentiate these groups into separate threat clusters. For instance, Dark Halo, another name associated with the Dukes, was responsible for the 2020 SolarWinds attack. In a recent alert, CERT-FR warned that Midnight Blizzard (aka Nobelium, APT29, Cozy Bear, and The Dukes) has been consistently attempting to exfiltrate strategic intelligence from embassies and diplomats. The targets have included various French government departments and embassies. The activities of the Dukes underline the persistent threat posed by state-sponsored cyber espionage groups.