UNC2452

UNC2452, also known as APT29, Cozy Bear, Nobelium, and Midnight Blizzard, is a highly skilled and disciplined threat actor group linked to Russia's SVR intelligence agency. The group gained notoriety for its role in the SolarWinds compromise in December 2020, an extensive cyberattack that involved a SUNBURST backdoor. Mandiant, a cybersecurity firm, gathered firsthand data on UNC2452's activities, leading to the attribution of this activity to APT29. The merging of UNC2452 into APT29 has significantly expanded our understanding of the latter, revealing its evolving operational security (OPSEC) measures, technical skills, and strategic intelligence collection. The group has shown a heightened level of OPSEC, blending into victim environments and hindering detection across all aspects of its operations. It has demonstrated the ability to bypass security controls, scale TTPs for emerging technology, and access internal systems and source code repositories of compromised companies. This suggests that the group may be preparing for future attacks by accumulating information on potential targets. Microsoft reported a tenfold increase in password-spraying attempts against its accounts in February, indicating an escalation in the group's activities. Mandiant has provided detailed strategies for remediation and hardening of Microsoft 365 to defend against UNC2452. These include detections and configuration recommendations available in Mandiant's UNC2452 Microsoft 365 Hardening Guide. Recent tactics employed by the group include using stolen Microsoft 365 instances to send Teams messages masquerading as IT support staff communications in an attempt to steal account credentials. The group has targeted around 40 government organizations, non-governmental organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors globally, demonstrating its broad reach and persistent threat.