UNC2452

Threat Actor updated 3 days ago (2024-11-08T12:44:46.907Z)
Download STIX
Preview STIX
UNC2452, also known as Midnight Blizzard, Cozy Bear, APT29, and Nobelium, is a sophisticated threat actor responsible for several high-profile cyber attacks. The group gained notoriety in December 2020 when it compromised SolarWinds' supply chain, an event tracked by Mandiant, a leading cybersecurity firm. After extensive evaluation and comparison, Mandiant concluded that UNC2452's activities could be attributed to APT29, a notorious hacking group. This conclusion significantly expanded our understanding of APT29, highlighting the group's evolution into a disciplined, highly skilled entity with advanced operational security measures aimed at intelligence collection. The group has targeted various sectors globally, including governmental agencies, higher education, defense, non-governmental organizations, IT services, technology, discrete manufacturing, and media sectors, with a particular focus on the UK, Europe, Australia, and Japan. Microsoft reported a tenfold increase in password-spraying attempts against its accounts in February, indicating an escalation in the group's activities. UNC2452 (APT29) is suspected of gaining access to Microsoft’s source code repositories and internal systems, potentially laying the groundwork for future attacks by accumulating information on potential targets. Merging UNC2452 into APT29 has allowed for a deeper understanding of the group's evolving tactics, techniques, and procedures (TTPs). The group has refined its technical skills to bypass security controls, blend in with victim environments, and hinder detection across all aspects of its operations. For instance, UNC2452 used stolen Microsoft 365 instances to send Teams messages masquerading as IT support staff communications, attempting to steal account credentials. To counter such threats, Mandiant provides detailed detection methods and configuration recommendations in its UNC2452 Microsoft 365 Hardening Guide.
Description last updated: 2024-10-31T02:02:12.426Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
APT29 is a possible alias for UNC2452. APT29, also known as Midnight Blizzard, Nobelium, or Cozy Bear, is a notorious threat actor linked to Russia. This entity has been involved in various cyber-attacks with malicious intent and its primary modus operandi involves collecting foreign intelligence and maintaining persistence in compromise
3
Cozy Bear is a possible alias for UNC2452. Cozy Bear, also known as APT29 and associated with the Russian Foreign Intelligence Service or SVR, is a significant threat actor in the field of cyber espionage. The group's activities date back to at least 2015, when it was identified intruding into the Democratic National Committee (DNC) network,
2
Midnight Blizzard is a possible alias for UNC2452. Midnight Blizzard, a Russia-linked threat actor also known as APT29, Cozy Bear, and several other names, has been identified as a major cybersecurity threat with a series of high-profile breaches. Microsoft systems have been breached multiple times by this group, with the most recent incident discov
2
NOBELIUM is a possible alias for UNC2452. Nobelium, a Russia-linked Advanced Persistent Threat (APT) group, also known under various aliases such as APT29, SVR group, BlueBravo, Cozy Bear, Midnight Blizzard, and The Dukes, has been actively involved in large-scale cyber espionage campaigns. The threat actor has been targeting French diploma
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Microsoft
Blizzard
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.