Cozy Bear

This article's lead section may be too short to adequately summarize the key points. Please consider expanding the lead to provide an accessible overview of all important aspects of the article. (December 2020)

Cozy Bear is a Russian advanced persistent threat hacker group believed to be associated with Russian foreign intelligence by United States intelligence agencies and those of allied countries.^[4][5] Dutch signals intelligence (AIVD) and American intelligence had been monitoring the group since 2014 and was able to link the hacker group to the Russian foreign intelligence agency (SVR) after compromising security cameras in their office.^[6] CrowdStrike and Estonian intelligence^[7] reported a tentative link to the Russian domestic/foreign intelligence agency (FSB).^[2] Various groups designate it CozyCar,^[8] CozyDuke,^[9][10] Dark Halo, The Dukes,^[11] Midnight Blizzard,^[12] NOBELIUM,^[13] Office Monkeys,^[14] StellarParticle, UNC2452^[15] with a tentative connection to Russian hacker group YTTRIUM.^[16] Symantec reported that Cozy Bear had been compromising diplomatic organizations and national governments since at least 2010.^[17] Der Spiegel published documents in 2023 purporting to link Russian IT firm NTC Vulkan to Cozy Bear operations.^[18]

APT29 has been observed to utilize a malware platform dubbed "Duke" which Kaspersky Lab reported in 2013 as "MiniDuke", observed in 2008 against United States and Western European targets.^[1] Its initial development was reportedly in assembly language.^[19] After Kaspersky's public reporting, later versions added C/C++ components and additional anti-analysis features. and were dubbed "Cozyduke", "Cosmicduke", "SeaDuke" and "OnionDuke"^[1][19]

Cozy Bear has been observed using an initial exploit or phishing email with malicious attachments to load a dropper which installs a Duke variant as a persistent trojan onto the target computer. It then gathers and sends data to a command and control server based on its configuration and/or live operator commands. Cozy Bear has been observed updating and refining its malware to improve cryptography, interactive functionality, and anti-analysis (including virtual machine detection).^[19][20]

CosmicDuke was observed in 2013 as an updated version of MiniDuke with a more flexible plugin framework. ^[21] In 2014 OnionDuke leveraged the Tor network to conceal its command and control traffic and was distributed by infecting binary executables on the fly if they were transmitted unencrypted through a Russia-based Tor exit node.^[22][23] "SeaDuke" appears to be a specialized trojan used in conjunction with other tools to compromise high-value targets.^[17]

The group reportedly developed the 'HAMMERTOSS' trojan in 2015 to evade detection by relaying commands over covert channels on Twitter and GitHub.^[24]

Cozy Bear has been observed targeting and compromising organizations and foreign governments worldwide (including Russian opposition countries such as NATO and Five Eyes) and the commercial sector (notably financial, manufacturing, energy and telecom).^[19] Targeting also included South America, and Asia (notably China and South Korea).^[25]. The United States is a frequent target, including the 2016 Clinton campaign, political parties (DNC, RNC), various executive agencies, the State Department and the White House.^[20]

Cozy Car malware was discovered on a Washington, D.C. based private research institute in March of 2014. Using compromised accounts at that organization, they sent phishing emails to other US government targets leveraging a malicious Flash file purporting to show "funny office monkeys".^[17][1] By July the group had compromised multiple government networks.^[17]

In the summer of 2014, the Dutch General Intelligence and Security Service (AIVD) infiltrated the camera network used by Cozy Bear's physical office. This footage confirmed targeting of the US Democratic Party, State Department and White House and may have been used in the FBI investigation into 2016 Russian election interference.^[6][26]

In August 2015 Cozy Bear was linked to a spear phishing campaign against the Pentagon, which the resulting investigation shut down the entire Joint Chiefs of Staff unclassified email system.^[27][28]

Cozy Bear and fellow Russian hacking group Fancy Bear (likely GRU) were identified as perpetuating the Democratic National Committee intrusion.^[2] While the two groups were both present in the DNC's servers at the same time, they appeared to operate independently.^[29] Further confirming their independent operations, computer forensics determined that Fancy Bear had only compromised the DNC for a few weeks while Cozy Bear had done so for over a year.^[30]

After the 2016 United States presidential election, Cozy Bear was linked to spear phishing campaigns against multiple U.S.-based think tanks and non-governmental organizations (NGOs) related to national security, defense, international affairs, public policy, and European and Asian studies. Some emails were sent from compromised Harvard accounts.^[31]

On 3 February 2017, the Norwegian Police Security Service (PST) reported that Cozy Bear had launched spear phishing campaigns against at least nine individuals across the Ministry of Defence, Ministry of Foreign Affairs, and the Labour Party in January of 2017.^[32] Other targets included the Norwegian Radiation Protection Authority and members of the Norwegian Police Security Service, including section chief Arne Christian Haugstøyl. Norwegian Prime Minister Erna Solberg called the acts "a serious attack on our democratic institutions."^[33]

Reported in February 2017, both Cozy Bear and Fancy Bear had been attempting to compromise into Dutch ministries since 2016. Targets included the Ministry of General Affairs. Then-head of the Dutch intelligence service AIVD Rob Bertholee, stated on EenVandaag television that the Russian intrusion had targeted government documents.^[34]

In response, Dutch Minister of the Interior and Kingdom Relations Ronald Plasterk announced that the March 2017 Dutch general election would be counted by hand.^[35]

In 2019 ESET reported that three malware variants had been attributed to Cozy Bear: PolyglotDuke, RegDuke and FatDuke. The malware had reportedly improved its anti-analysis methods and had been observed being used in intrusion campaigns dubbed "Operation Ghost".^[36]

in July 2020 Five Eyes intelligence agencies NSA, NCSC and CSE reported that Cozy Bear had attempted to obtain Covid 19 vaccine data via intrusion campaigns.^{[37][38][39][40][4]}

On 8 December 2020, U.S. cybersecurity firm FireEye disclosed that their internal tools had been stolen by a nation-state.^[41][42] Later investigations implicated an internal compromise of software deployments of SolarWinds Orion IT management product to distribute a trojan that FireEye dubbed SUNBURST.^[43] SolarWinds later confirmed that it had been compromised by a foreign nation state.^[44] and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive that U.S. government agencies rebuild the affected software from trusted sources. It also attributed the intrusion campaign to the Russian SVR.^[45] Approximately 18,000 SolarWinds clients were vulnerable to the compromised Orion software.^[46] The Washington Post cited anonymous sources that attributed Cozy Bear as the perpetrator.^[47][4]

According to Microsoft,^[48] the hackers compromised Solarwinds code signing certificates and deployed a backdoor that allowed impersonation of a target’s user account via a malicious Security Assertion Markup Language definition.^[49]

On 20 December 2020 the U.S. Government reported that Cozy Bear was responsible for compromising the networks of civilian agencies Department of Commerce and Department of the Treasury.^[50]

In July 2021, Cozy Bear breached systems of the Republican National Committee.^[51][52] Officials said they believed the attack to have been conducted through Synnex, a compromised third-party IT vendor.^[51]

In 2021 Microsoft reported that Cozy Bear was leveraging the "FoggyWeb" tool to dump authentication tokens from compromised Active Directory instances. This was performed after they gained access to a machine on the target network and were able to obtain AD administrator credentials.^[53] On 24 August 2022, Microsoft reported the group ha deployed a similar tool "MagicWeb" to bypass user authentication on affected Active Directory Federated Services servers.^[54]

In January 2024, Microsoft reported having recently discovered and ended a breach beginning the previous November of the email accounts of their senior leadership and other employees in the legal and cybersecurity teams using a "password spray", a form of brute-force attack. This hack conducted by Midnight Blizzard appears to have aimed to find what the company knew about the hacking operation.^[55]

German technology company TeamViewer SE reported on June 28 2024 its corporate IT network had been compromised by Cozy Bear.^[56] It stated that user data and its TeamViewer remote desktop software product was unaffected.^[57]

• 2016 United States election interference by Russia
• The Plot to Hack America
• Vulkan files leak

• Russian government employees charged in hacking campaigns