Midnight Blizzard

Actor Type Nation State
Attributed to Nation Russia
Directly Linked Intrusion Sets APT29 , NOBELIUM , Cozy Bear , The Dukes
Associated Threat Actor SVR - Russian Foreign Intelligence Service

Microsoft identied Midnight Blizzard as the attackers behind the 2020 attack against SolarWinds. The group have been linked to the APT29 intrusion set and Russia's SVR.

'Midnight Blizzard' was previously tracked by Microsoft as NOBELIUM.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Midnight Blizzard Threat Reports

Report

Malicious Activities Linked to the Nobelium Intrusion Set

This report by ANSSI, the French 'Agence nationale de la sécurité des systèmes d'information', outlines activity against French diplomatic ...

View Source
Report

Midnight Blizzard: Guidance for responders on nation-state attack

Following a compromise of Microsoft corporate systems by Midnight Blizzard which was detected on 12th January 2024, this blog post outlines ...

View Source
Report

SVR cyber actors adapt tactics for initial cloud access

This advisory from the UK's National Cyber Security Centre (NCSC) outlines tactics, techniques and procedures (TTPs) used by the cyber actors ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

ATT&CK ID Title Associated Tactics
T1114.002 Remote Email Collection Collection
T1110.003 Password Spraying Credential Access
T1090.002 External Proxy Command and Control
T1098.005 Device Registration Persistence, Privilege Escalation
T1110 Brute Force Credential Access
T1621 Multi-Factor Authentication Request Generation Credential Access
T1528 Steal Application Access Token Credential Access
T1078.004 Cloud Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation