APT29Threat actor

“Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia’s Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep.”

“ConsentFix is a ClickFix-OAuth hybrid first observed in Russian APT29 campaigns that has since been commoditized into criminal tooling.”

“… in question, which Anthropic calls GTG-20006 (Generative Threat Group), is "consistent with public reporting linking the actor to Midnight Blizzard", a group linked to Russia's foreign intelligence service, the SVR.”

“We assess with moderate confidence that UNC6293 is a sub cluster of ICE RELIC (formerly APT29) responsible for initial access operations.”

“Midnight Blizzard Targets Travelers via Captive Portals”

“…understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise of SolarWinds and North Korean cyber espionage actor UNC4736's 2023 compromise of 3CX.”

“Of note, both APT28 and APT29 (attributed to Russia’s foreign intelligence service SVR) were observed looking to compromise the same target, which suggests a possibility of executive-initiated priority targeting.”

“This leads to a cross-tenant compromise similar to Midnight Blizzard.”

“Between November 2023 and July 2024, the Russia-nexus intrusion set APT29, a group operated by the Russian foreign intelligence service SVR, was observed by Google's Threat Analysis Group (TAG) using exploits that are extremely similar to those previously used by commercial surve…”

“This is the same risk as using third-party applications, which can lead to incidents like Midnight Blizzard.”

“…ber threat landscape was defined by a handful of known actors: Pawn Storm (also known as APT28), Sandworm, Earth Koshchei (also known as APT29), Turla, and Earth Dahu (also known as Gamaredon).”

“Teams such as APT29, UNC2452, and Lazarus use upstream compromise to establish long-term, covert access to high-value networks.”

“… failed login attempts” and one that says “we’ve detected a coordinated attack pattern targeting administrative accounts, similar to the APT29 campaign identified last week, with an 87% probability of being a real attack based on timing and origin of attempts.””

“These active scans are part of mass, opportunistic efforts, a tactic commonly used by threats actors like APT 29 (Cozy Bear), although GreyNoise does not attribute malicious activity directly.”

“On January 19, 2024 Microsoft released a statement regarding the threat actor group named “Midnight Blizzard”—this state-sponsored actor was observed by Microsoft as performing password spraying against a legacy tenant, from which the threat actor was able to gain a foothold and…”

“…d behavior represents DLL search order hijacking or sideloading attempts, as seen in examples ranging from state-sponsored threat actor Nobelium’s FoggyWeb backdoor installation to abuse of signed Microsoft executables to install Brute Ratel.”

“We set up test ranges for Emotet and Koadic, and also tested it on NOBELIUM logs we had from several months ago.”

“…02) to a Google Drive is another option for adversaries who may be using the service to host and deploy malicious payloads as those from APT29.”

“Threat actors like APT34, APT29, and FIN6 have been known to use scheduled tasks as a means to persist.”

“Analysing the activities of advanced groups like APT28 and Dark Halo is much more difficult.”