The Dukes

The Dukes, also known as APT29, Cozy Bear, Midnight Blizzard, and Nobelium, is a threat actor associated with the Russian government that has been active since at least 2008. Notably, this group was implicated in the 2015 attack on the American Democratic National Committee (DNC). The FBI alerted the DNC to suspicious network activity in September 2015, referencing the Dukes as the potential source. Despite repeated warnings from the FBI throughout late 2015, the Dukes continued their malicious activities, launching several waves of highly targeted spear phishing attacks against U.S.-based think tanks and NGOs in August 2016. The Dukes' activities have evolved over time, with notable operations including the StellarParticle campaign and the SolarWinds intrusion in December 2020. Both campaigns were tracked by cybersecurity firm CrowdStrike and were linked to the SUNSPOT implant. Post-election attacks launched by the Dukes on November 9 bore similarities to previous attacks seen from the group in both 2015 and 2016. More recently, TeamViewer discovered a breach in its corporate network attributed to the Dukes, highlighting the ongoing threat posed by this group. In addition to these operations, the Dukes have been involved in multiple cyberespionage campaigns targeting various governments, diplomatic entities, and political parties. Threat intelligence firms have warned that the Dukes have amplified their global cyberespionage operations as part of Moscow's ongoing war against Ukraine. This includes attempts to exfiltrate strategic intelligence from embassies and diplomats, with targets including the French Ministry of Culture, the National Agency for Territorial Cohesion, and the French Ministry of Foreign Affairs. Despite these escalating threats, agencies such as France's ANSSI differentiate these groups into separate threat clusters, indicating the complex and multifaceted nature of the threat landscape.