Cozy Bear

Actor Type	Nation State
Attributed to Nation	Russia
Directly Linked Intrusion Sets	APT29 , Midnight Blizzard , The Dukes , NOBELIUM
Associated Threat Actor	SVR - Russian Foreign Intelligence Service

COZY BEAR is a Russian adversary tracked by CrowdStrike and linked to the SVR. COZY BEAR is one of the adversaries identified during the intrusion against the US Democratic National Committee in 2016.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Cozy Bear Threat Reports

Report

Midnight Blizzard: Guidance for responders on nation-state attack

Following a compromise of Microsoft corporate systems by Midnight Blizzard which was detected on 12th January 2024, this blog post outlines ...

View Source

Report

SVR cyber actors adapt tactics for initial cloud access

This advisory from the UK's National Cyber Security Centre (NCSC) outlines tactics, techniques and procedures (TTPs) used by the cyber actors ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1114.002	Remote Email Collection	Collection
T1110.003	Password Spraying	Credential Access
T1090.002	External Proxy	Command and Control
T1098.005	Device Registration	Persistence, Privilege Escalation
T1110	Brute Force	Credential Access
T1621	Multi-Factor Authentication Request Generation	Credential Access
T1528	Steal Application Access Token	Credential Access
T1078.004	Cloud Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation

Showing 1 to 8 of 8 entries

Cozy Bear

Cyber Threat Graph Context

Cozy Bear Threat Reports

Midnight Blizzard: Guidance for responders on nation-state attack

SVR cyber actors adapt tactics for initial cloud access

References

www.crowdstrike.com

www.cisa.gov

www.microsoft.com

www.ncsc.gov.uk

MITRE ATT&CK Techniques