RussiaAttributedSVREspionageActive 2008 – 2026Cozy Bear
Also known asMidnight Blizzard · NOBELIUM · The Dukes · BlueBravo · Cloaked Ursa · Earth Koshchei · CozyLarch · ICECAP · Iron Hemlock · UNC2452 · Dukes · Group 100 · Cozy Duke · Office Monkeys · TEMP.Monkeys · Yttrium · ATK 7 · ITG11 · Dark Halo · SolarStorm · StellarParticle · Iron Ritual · UNC3524 · Cranefly · Blue Dev 5 · NobleBaron · Solar Phoenix · Blue Kitsune · TA421 · UAC-0029 · Storm-2945
Summary
Russian Foreign Intelligence Service (SVR) espionage actor — Microsoft's Midnight Blizzard, Mandiant's APT29, CrowdStrike's Cozy Bear (also NOBELIUM, UNC2452, The Dukes). Newest activity: CaptiveCrunch (May 2026 → at least Sep 2026) — Microsoft's Storm-2945 sub-cluster manipulates hotel and public Wi-Fi captive portals to push the CornFlake RAT and ChocoShell stealer and harvest travellers' credentials. 2025: GRAPELOADER/WINELOADER 'wine-tasting' phishing against European diplomats (Check Point, Jan–Apr) and a watering hole abusing the Microsoft device-code flow, disrupted by Amazon (Aug). 2023–2024: password spray of a legacy Microsoft test tenant, then access to Microsoft corporate email (from late Nov 2023, detected 12 Jan 2024); mass exploitation of JetBrains TeamCity CVE-2023-42793 (AA23-347A, from Sep 2023). Assessed, not confirmed: Google's UNC6293 abuse of application-specific passwords (2025, linked to APT29 only at low confidence) and Volexity's medium-confidence CozyLarch device-code phishing (Feb 2025). History: SolarWinds/SUNBURST supply chain (2019–2021), Operation Ghost, and exploitation of Citrix, Pulse Secure, Fortinet and Zimbra VPN/mail flaws (2019–2021).
Attribution
Russian Foreign Intelligence Service
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- NSA, FBI, CISA and partners (AA23-347A) (Government, 2023-12-13)
Joint advisory names the SVR as APT29 - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to Russia's Foreign Intelligence Service (SVR)
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| CaptiveCrunch — captive-portal traffic manipulation against travelers (Storm-2945 sub-cluster) | 2026-05 – ongoing | Global | Hospitality, Government, Diplomatic, Corporate travelers | Microsoft Threat Intelligence (2026-07-31, updated 2026-10-05) |
| Watering hole abusing Microsoft device-code flow (disrupted by Amazon) | 2025-08 | Global | Multiple | Amazon Threat Intelligence (2025-08-29) |
| GRAPELOADER wine-tasting phishing against European diplomats | 2025-01 – 2025-04 | EU, Embassies in Europe | Government, Diplomatic | Check Point Research (2025-04-15) |
| Microsoft Corporate Email Compromise | 2023-11 – 2024-01 | USA, Global | Technology | Microsoft MSRC (2024-01-19); Microsoft Threat Intelligence (2024-01-25) |
| TeamCity Mass Exploitation | 2023-09 – 2023-12 | Global | Technology, Software | FBI/CISA/NSA/SKW/CERT Polska/NCSC AA23-347A (2023-12-13) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 13
| Initial Access2 | T1195.002Compromise Software Supply ChainT1189Drive-by Compromise |
|---|---|
| Execution1 | T1059.001PowerShell |
| Persistence2 | T1078Valid AccountsT1078.004Cloud Accounts |
| Stealth2 | T1055Process InjectionT1574.001DLL |
| Credential Access3 | T1528Steal Application Access TokenT1110.003Password SprayingT1557Adversary-in-the-Middle |
| Lateral Movement2 | T1550.002Pass the HashT1550.001Application Access Token |
| Command and Control1 | T1573Encrypted Channel |
Malware and tools 12
| Name | Description | Platform |
|---|---|---|
| SUNBURST | Supply-chain Backdoor | Windows |
| WINELOADER | Modular Backdoor | Windows |
| ROOTSAW | HTML Dropper | Windows |
| CozyDuke | RAT (legacy) | Windows |
| MagicWeb | Post-exploitation DLL (AD FS hijack) | Windows |
| GraphicalNeutrino | C2 Loader | Windows |
| GRAPELOADER | Loader (DLL side-loaded) | Windows |
| CornFlake | RAT / infostealer (Go; Rust variant) | Windows |
| ChocoShell | PowerShell infostealer | Windows |
| SeaDuke | Backdoor (legacy) | Windows |
| HAMMERTOSS | Backdoor (legacy, social-media C2) | Windows |
| CloudDuke | Backdoor (legacy, cloud-storage C2) | Windows |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2019-11510 | 9.9 | Pulse Connect Secure — arbitrary file read (KEV 2021-11-03) |
| CVE-2019-19781 | 9.8 | Citrix ADC / Gateway — path traversal (KEV 2021-11-03) |
| CVE-2019-9670 | 9.8 | Synacor Zimbra Collaboration — XXE (KEV 2022-01-10) |
| CVE-2023-42793 | 9.8 | JetBrains TeamCity (KEV 2023-10-04) |
| CVE-2018-13379 | 9.1 | Fortinet FortiOS (KEV 2021-11-03) |
| CVE-2021-36934 | 7.8 | Windows SAM "HiveNightmare/SeriousSAM" — privilege escalation (KEV 2022-02-10) |
Highest CVSS first.
Infrastructure patterns
- Captive-portal AitM on hotel networks via manipulated DNS/HTTP, run from the FruitStone panel (Microsoft, 2026)
- Residential proxies and Azure VMs hide its access; meek domain fronting over Tor hides C2 (MITRE ATT&CK, 2026)
- Dynamic DNS for C2; generated Twitter handles as C2 for HAMMERTOSS (MITRE ATT&CK, 2026)
Reporting and advisories 7
- CISA
AA20-352A — SolarWinds Supply Chain - CISA
AA23-347A — JetBrains TeamCity - Microsoft MSRC
Microsoft Corporate Email Compromise - Check Point Research
GRAPELOADER wine-tasting phishing against European diplomats - Amazon Threat Intelligence
Watering hole abusing Microsoft device-code flow (disrupted by Amazon) - Microsoft Threat Intelligence
CaptiveCrunch — captive-portal traffic manipulation against travelers (Storm-2945 sub-cluster) - MITRE ATT&CK
Cozy Bear (G0016) group profile