The Dukes

Threat Actor updated 13 days ago (2024-11-08T13:27:35.044Z)

Download STIX

Preview STIX

The Dukes, also known as APT29, Cozy Bear, Midnight Blizzard, Nobelium, and BlueBravo, is a threat actor associated with the Russian government. The group has been active since at least 2008 and has targeted various governments, think tanks, diplomatic entities, and political parties. Notably, in September 2015, the FBI alerted the DNC's IT director about suspicious activity linked to the Dukes. Despite repeated warnings from the FBI in October, November, and December of 2015, the Dukes continued their nefarious activities. They launched several waves of highly targeted spear-phishing attacks against U.S.-based think tanks and NGOs in August 2016. Post-election attacks launched by the Dukes on November 9 were similar to previous attacks seen in both 2015 and 2016. In addition to these activities, the Dukes have been involved in significant cybersecurity incidents. They were associated with the StellarParticle campaign, which was related to the SUNSPOT implant from the SolarWinds intrusion in December 2020. More recently, they have been involved in large-scale spear-phishing campaigns targeting over 1,000 users across more than 100 organizations for intelligence gathering. This includes an attack on TeamViewer's corporate network. Furthermore, the Dukes have targeted vulnerable Zimbra and JetBrains TeamCity servers as part of a mass scale campaign, as warned by U.S. and U.K. cyber agencies. Despite the various aliases, all these groups are considered part of the same threat cluster due to their shared tactics, techniques, and procedures (TTPs). However, some organizations, such as the French agency ANSSI, differentiate these groups into separate threat clusters. For instance, Dark Halo, another name associated with the Dukes, was responsible for the 2020 SolarWinds attack. In a recent alert, CERT-FR warned that Midnight Blizzard (aka Nobelium, APT29, Cozy Bear, and The Dukes) has been consistently attempting to exfiltrate strategic intelligence from embassies and diplomats. The targets have included various French government departments and embassies. The activities of the Dukes underline the persistent threat posed by state-sponsored cyber espionage groups.

Description last updated: 2024-10-30T21:02:52.678Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
APT29 is a possible alias for The Dukes. APT29, also known as Midnight Blizzard and linked to Russia's Foreign Intelligence Service (SVR), is a notorious threat actor that has been implicated in several high-profile cyberattacks. The group has demonstrated sophisticated capabilities, exploiting vulnerabilities such as the WinRAR 0day flaw	5
Midnight Blizzard is a possible alias for The Dukes. Midnight Blizzard, also known as APT29 and Cozy Bear, is a Russia-linked threat actor group believed to be tied to the country's Foreign Intelligence Service (SVR). The group has been implicated in several high-profile cyber attacks, including breaches of Microsoft and Hewlett Packard Enterprise (HP	5
NOBELIUM is a possible alias for The Dukes. Nobelium, a Russia-linked Advanced Persistent Threat (APT) group, also known under various aliases such as APT29, SVR group, BlueBravo, Cozy Bear, Midnight Blizzard, and The Dukes, has been actively involved in large-scale cyber espionage campaigns. The threat actor has been targeting French diploma	4
Cozy Bear is a possible alias for The Dukes. Cozy Bear, also known as APT29 and Midnight Blizzard, is a threat actor believed to be linked to the Russian government. This entity has been behind numerous cyberattacks with malicious intent, targeting various organizations and systems worldwide. The first significant intrusion attributed to Cozy	4
Bluebravo is a possible alias for The Dukes. BlueBravo, a threat actor linked to the Russia-based Advanced Persistent Threat (APT) group APT29, has been identified as a significant cyber threat. Also known by various other names such as SVR Group, Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes, this entity is suspected of conducting sev	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Apt

Implant

Phishing

Spearphishing

Malware

France

Vulnerability

WinRAR

Russia

Exploit

Blizzard

Espionage

Microsoft

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Brute Ratel Malware is associated with The Dukes. Brute Ratel C4 (BRc4) is a potent malware that has been used in various cyber-attacks over the past 15 years. The malware infects systems through deceptive MSI installers, which deploy the BRc4 by disguising the payload as legitimate software such as vierm_soft_x64.dll under rundll32 execution. Vari	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Sednit Threat Actor is associated with The Dukes. Sednit, also known as APT28, Fancy Bear, Strontium/Forest Blizzard, Pawn Storm, Sofacy, and BlueDelta, is a threat actor group associated with Russia’s military intelligence. This group has been active since at least 2007, targeting governments, militaries, and security organizations worldwide. Sedn	Unspecified	2
The APT28 Threat Actor is associated with The Dukes. APT28, also known as Fancy Bear and Unit 26165 of the Russian Main Intelligence Directorate, is a threat actor linked to Russia with a history of cyber-espionage activities. The group has been involved in several high-profile attacks, including the hacking of the Democratic National Committee (DNC)	Unspecified	2
The Sandworm Threat Actor is associated with The Dukes. Sandworm, a threat actor linked to Russia, has been identified as the primary cyber attack unit supporting Russian military activities in Ukraine. This group is notorious for its sophisticated and disruptive cyber attacks, including the compromise of 11 Ukrainian telecommunications providers which c	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The CVE-2023-38831 Vulnerability is associated with The Dukes. CVE-2023-38831 is a critical vulnerability identified in the WinRAR software, with a CVSS score of 7.8, indicating high severity. This flaw in software design or implementation has been exploited to disseminate the LONEPAGE malware through ZIP files using an exploit known as UAC-0099. The vulnerabil	Targets	2

Source Document References

Information about the The Dukes Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securityaffairs	22 days ago	Russia-linked Midnight Blizzard APT targeted 100+ organizations with a spear-phishing campaign using RDP files
Securityaffairs	a month ago	Russia-linked group APT29 is targeting Zimbra and JetBrains TeamCity servers on a large scale
InfoSecurity-magazine	a month ago	Russia's SVR Targets Zimbra, TeamCity Servers for Cyber Espionage
Securityaffairs	3 months ago	Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa
Securityaffairs	5 months ago	Russia-linked group APT29 likely breached TeamViewer
Securityaffairs	5 months ago	Russia's Midnight Blizzard stole email of more Microsoft customers
Securityaffairs	5 months ago	Russia-linked APT Nobelium targets French diplomatic entities
DARKReading	5 months ago	Russia's Midnight Blizzard Seeks to Snow French Diplomats
InfoSecurity-magazine	5 months ago	French Diplomatic Entities Targeted by Russian-Aligned Nobelium
BankInfoSecurity	8 months ago	Phishing Attacks Targeting Political Parties, Germany Warns
BankInfoSecurity	8 months ago	Russian Nation-State Hacker Targets German Political Parties
Securityaffairs	8 months ago	Russia-linked Midnight Blizzard breached Microsoft systems again
CERT-EU	9 months ago	UK's NCSC Issues Warning as SVR Hackers Target Cloud Services
CERT-EU	9 months ago	APT29 Tactics Revealed: A Joint Advisory by Five Eyes Cybersecurity Agencies
CERT-EU	9 months ago	Russia-linked APT29 switched to targeting cloud services
CERT-EU	9 months ago	Five Eyes Agencies Expose APT29’s Evolving Cloud Attack Tactics
Securityaffairs	9 months ago	Russia-linked APT29 switched to targeting cloud services
CERT-EU	9 months ago	Attacks That Change the Course of History
Securityaffairs	10 months ago	Midnight Blizzard APT is targeting orgs worldwide, Microsoft warns
Securityaffairs	10 months ago	Russia-linked APT group Midnight Blizzard hacked HPE