APT29 (Cozy Bear)

Background

APT29, commonly referred to by the nickname "Cozy Bear" (also known under aliases including The Dukes, CozyDuke, Dark Halo, UNC2452, NOBELIUM, Midnight Blizzard, and BlueBravo), is a cyberespionage threat group that security researchers and Western governments assess is linked to Russia's Foreign Intelligence Service (SVR), with some analyses noting tentative historical links to the FSB. The group has been tracked by security researchers and intelligence services since at least 2008, and Dutch and American intelligence agencies reportedly monitored its activity closely beginning around 2014. Its operations are generally characterized by a strong emphasis on stealth, long-term persistence inside victim networks, and intelligence-gathering objectives rather than disruptive or destructive effects.

Early Activity and Targeting

APT29's documented activity dates back over a decade, with early campaigns targeting government networks in Europe and among NATO member states, as well as research institutes, think tanks, and diplomatic organizations. Reporting on incidents attributed to the group describes intrusions into U.S. government networks, including reports around 2014-2015 of compromises affecting unclassified networks such as the U.S. State Department and Pentagon email systems. The group's tradecraft during this period included spear-phishing campaigns delivering custom malware families collectively referred to by researchers as "the Dukes," alongside the use of legitimate cloud services and command-and-control infrastructure designed to blend in with normal network traffic.

The 2016 DNC Breach

APT29 has been identified, alongside the separately tracked group APT28 ("Fancy Bear"), as one of the actors that compromised the network of the Democratic National Committee (DNC) beginning around the summer of 2015 and continuing into 2016. Incident responders at CrowdStrike, who were called in to investigate the DNC breach, publicly attributed the intrusions to two distinct Russian-linked groups operating independently within the same network. The DNC breach became a major point of public attention during the 2016 U.S. presidential election cycle and contributed to broader U.S. government findings regarding Russian interference in the election.

The SolarWinds/Sunburst Supply-Chain Attack

The most extensively documented APT29 operation is the SolarWinds supply-chain compromise, discovered and publicly disclosed in December 2020. Attackers inserted a backdoor, subsequently named "Sunburst" (or "Solorigate"), into legitimate software updates for the SolarWinds Orion IT-monitoring platform. Because Orion was used by a large number of organizations, the trojanized update was distributed to an estimated 18,000 SolarWinds customers, though only a smaller subset of high-value targets were subsequently and selectively compromised further by the operators. Confirmed and reported victims included multiple U.S. federal agencies, among them the Departments of Treasury, Commerce, State, and Homeland Security, as well as private-sector technology companies. In April 2021, the United States and United Kingdom governments formally attributed the SolarWinds campaign to Russia's SVR, publishing joint technical advisories describing the actor's tactics, techniques, and procedures under the designation APT29.

Continued Operations

Following the SolarWinds disclosure, security researchers continued to track APT29 activity under names such as NOBELIUM and Midnight Blizzard. Reported post-2020 operations have included attempted theft of COVID-19 vaccine research data, the deployment of specialized authentication-bypass tools such as FoggyWeb and MagicWeb against Active Directory Federation Services environments, and, in 2024, disclosed compromises affecting the email accounts of senior Microsoft leadership and related corporate infrastructure. The group has consistently been characterized by researchers as one of the more technically sophisticated and operationally patient state-sponsored threat actors publicly tracked.

Significance and Legacy

APT29's operations, particularly the SolarWinds/Sunburst campaign, are widely cited as a turning point in industry and government thinking about software supply-chain security, prompting new U.S. federal directives (including CISA Emergency Directive 21-01) and influencing subsequent policy such as Executive Order 14028 on improving the nation's cybersecurity. Alongside APT28/Fancy Bear, APT29's role in the 2016 DNC breach also made it one of the most publicly discussed examples of state-sponsored cyberespionage intersecting with democratic political processes. The group remains one of the most closely watched nation-state threat actors in ongoing cybersecurity threat-intelligence reporting.

Timeline

• 2008Security researchers and intelligence services assess APT29 (Cozy Bear) has been active since at least this year.
• 2014Reports emerge of APT29 intrusions into U.S. government networks, including unclassified State Department and Pentagon email systems.
• 2015-06APT29 is reported to have begun compromising the network of the Democratic National Committee (DNC).
• 2016-06CrowdStrike publicly attributes the DNC network breach to two Russian-linked groups, APT28 and APT29, operating independently within the same environment.
• 2020-12The SolarWinds Orion supply-chain compromise, involving the Sunburst backdoor, is publicly disclosed by FireEye and Microsoft, affecting thousands of organizations including multiple U.S. federal agencies.
• 2021-04The United States and United Kingdom governments formally attribute the SolarWinds/Sunburst campaign to Russia's SVR, tracked as APT29.
• 2021Microsoft begins tracking related activity under the name NOBELIUM, later renamed Midnight Blizzard.
• 2024Microsoft discloses that Midnight Blizzard (APT29) compromised email accounts belonging to members of its senior leadership team.