Cozy Bear Explained

Cozy Bear
Formation: 2008
Type:Advanced persistent threat
Purpose:Cyberespionage, cyberwarfare
Region:Russia
Methods:Spearphishing, malware
Language:Russian
Parent Organization:SVR(confirmed), FSB (tentative)[1]
Affiliations:Fancy Bear
Formerly:APT29, CozyCar, CozyDuke, Dark Halo, The Dukes, Grizzly Steppe (when combined with Fancy Bear), NOBELIUM, Office Monkeys, StellarParticle, UNC2452, YTTRIUM (possibly)

Cozy Bear is a Russian advanced persistent threat hacker group believed to be associated with Russian foreign intelligence by United States intelligence agencies and those of allied countries.[2] [3] Dutch signals intelligence (AIVD) and American intelligence had been monitoring the group since 2014 and was able to link the hacker group to the Russian foreign intelligence agency (SVR) after compromising security cameras in their office. CrowdStrike and Estonian intelligence[4] reported a tentative link to the Russian domestic/foreign intelligence agency (FSB).[5] Various groups designate it CozyCar,[6] CozyDuke,[7] [8] Dark Halo, The Dukes,[9] Midnight Blizzard,[10] NOBELIUM,[11] Office Monkeys,[12] StellarParticle, UNC2452[13] with a tentative connection to Russian hacker group YTTRIUM.[14] Symantec reported that Cozy Bear had been compromising diplomatic organizations and national governments since at least 2010.[15] Der Spiegel published documents in 2023 purporting to link Russian IT firm NTC Vulkan to Cozy Bear operations.[16]

Intrusion Methods

APT29 has been observed to utilize a malware platform dubbed "Duke" which Kaspersky Lab reported in 2013 as "MiniDuke", observed in 2008 against United States and Western European targets. Its initial development was reportedly in assembly language. After Kaspersky's public reporting, later versions added C/C++ components and additional anti-analysis features. and were dubbed "Cozyduke", "Cosmicduke", "SeaDuke" and "OnionDuke"

Cozy Bear has been observed using an initial exploit or phishing email with malicious attachments to load a dropper which installs a Duke variant as a persistent trojan onto the target computer. It then gathers and sends data to a command and control server based on its configuration and/or live operator commands. Cozy Bear has been observed updating and refining its malware to improve cryptography, interactive functionality, and anti-analysis (including virtual machine detection).

CosmicDuke was observed in 2013 as an updated version of MiniDuke with a more flexible plugin framework. [17] In 2014 OnionDuke leveraged the Tor network to conceal its command and control traffic and was distributed by infecting binary executables on the fly if they were transmitted unencrypted through a Russia-based Tor exit node.[18] [19] "SeaDuke" appears to be a specialized trojan used in conjunction with other tools to compromise high-value targets.

The group reportedly developed the 'HAMMERTOSS' trojan in 2015 to evade detection by relaying commands over covert channels on Twitter and GitHub.[20]

Intrusion Campaigns

Cozy Bear has been observed targeting and compromising organizations and foreign governments worldwide (including Russian opposition countries such as NATO and Five Eyes) and the commercial sector (notably financial, manufacturing, energy and telecom).[21] Targeting also included South America, and Asia (notably China and South Korea).[22] The United States is a frequent target, including the 2016 Clinton campaign, political parties (DNC, RNC), various executive agencies, the State Department and the White House.[23]

Intrusion into U.S. Government agencies (2014)

Cozy Car malware was discovered on a Washington, D.C. based private research institute in March 2014. Using compromised accounts at that organization, they sent phishing emails to other US government targets leveraging a malicious Flash file purporting to show "funny office monkeys".[24] By July the group had compromised multiple government networks.[15]

Exposure by Dutch Intelligence (2014)

In the summer of 2014, the Dutch General Intelligence and Security Service (AIVD) infiltrated the camera network used by Cozy Bear's physical office. This footage confirmed targeting of the US Democratic Party, State Department and White House and may have been used in the FBI investigation into 2016 Russian election interference.[25] [26]

Intrusion into Pentagon email servers (2015)

In August 2015 Cozy Bear was linked to a spear phishing campaign against the Pentagon, which the resulting investigation shut down the entire Joint Chiefs of Staff unclassified email system.[27] [28]

Intrusion into the U.S. Democratic National Committee (2016)

See main article: Democratic National Committee cyber attacks. Cozy Bear and fellow Russian hacking group Fancy Bear (likely GRU) were identified as perpetuating the Democratic National Committee intrusion. While the two groups were both present in the DNC's servers at the same time, they appeared to operate independently.[29] Further confirming their independent operations, computer forensics determined that Fancy Bear had only compromised the DNC for a few weeks while Cozy Bear had done so for over a year.[30]

Attempted intrusion into US Think tanks and NGOs (2016)

After the 2016 United States presidential election, Cozy Bear was linked to spear phishing campaigns against multiple U.S.-based think tanks and non-governmental organizations (NGOs) related to national security, defense, international affairs, public policy, and European and Asian studies. Some emails were sent from compromised Harvard accounts.[31]

Attempted intrusion into Norwegian Government (2017)

On 3 February 2017, the Norwegian Police Security Service (PST) reported that Cozy Bear had launched spear phishing campaigns against at least nine individuals across the Ministry of Defence, Ministry of Foreign Affairs, and the Labour Party in January 2017.[32] Other targets included the Norwegian Radiation Protection Authority and members of the Norwegian Police Security Service, including section chief Arne Christian Haugstøyl. Norwegian Prime Minister Erna Solberg called the acts "a serious attack on our democratic institutions."[33]

Attempted intrusion into Dutch Ministries (2016-2017)

Reported in February 2017, both Cozy Bear and Fancy Bear had been attempting to compromise into Dutch ministries since 2016. Targets included the Ministry of General Affairs. Then-head of the Dutch intelligence service AIVD Rob Bertholee, stated on EenVandaag television that the Russian intrusion had targeted government documents.[34]

In response, Dutch Minister of the Interior and Kingdom Relations Ronald Plasterk announced that the March 2017 Dutch general election would be counted by hand.[35]

Duke variants and Operation Ghost (2019)

In 2019 ESET reported that three malware variants had been attributed to Cozy Bear: PolyglotDuke, RegDuke and FatDuke. The malware had reportedly improved its anti-analysis methods and had been observed being used in intrusion campaigns dubbed "Operation Ghost".[36]

Attempted theft of COVID-19 vaccine data (2020)

in July 2020 Five Eyes intelligence agencies NSA, NCSC and CSE reported that Cozy Bear had attempted to obtain COVID-19 vaccine data via intrusion campaigns.[37] [38] [39] [40] [2]

SUNBURST malware supply chain attack (2020)

See main article: 2020 United States federal government data breach. On 8 December 2020, U.S. cybersecurity firm FireEye disclosed that their internal tools had been stolen by a nation-state.[41] [42] Later investigations implicated an internal compromise of software deployments of SolarWinds Orion IT management product to distribute a trojan that FireEye dubbed SUNBURST.[43] SolarWinds later confirmed that it had been compromised by a foreign nation state.[44] and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive that U.S. government agencies rebuild the affected software from trusted sources. It also attributed the intrusion campaign to the Russian SVR.[45] Approximately 18,000 SolarWinds clients were vulnerable to the compromised Orion software.[46] The Washington Post cited anonymous sources that attributed Cozy Bear as the perpetrator.[47]

According to Microsoft,[48] the hackers compromised Solarwinds code signing certificates and deployed a backdoor that allowed impersonation of a target's user account via a malicious Security Assertion Markup Language definition.[49]

Intrusion into U.S. Civilian Agencies (2020)

On 20 December 2020 the U.S. Government reported that Cozy Bear was responsible for compromising the networks of civilian agencies Department of Commerce and Department of the Treasury.[50]

Intrusion into the U.S. Republican National Committee (2021)

In July 2021, Cozy Bear breached systems of the Republican National Committee.[51] [52] Officials said they believed the attack to have been conducted through Synnex, a compromised third-party IT vendor.

Active Directory authentication bypasses (2021–2022)

In 2021 Microsoft reported that Cozy Bear was leveraging the "FoggyWeb" tool to dump authentication tokens from compromised Active Directory instances. This was performed after they gained access to a machine on the target network and were able to obtain AD administrator credentials.[53] On 24 August 2022, Microsoft reported the group has deployed a similar tool "MagicWeb" to bypass user authentication on affected Active Directory Federated Services servers.[54]

Intrusion into Microsoft (2024)

In January 2024, Microsoft reported having recently discovered and ended a breach beginning the previous November of the email accounts of their senior leadership and other employees in the legal and cybersecurity teams using a "password spray", a form of brute-force attack. This hack conducted by Midnight Blizzard appears to have aimed to find what the company knew about the hacking operation.[55]

Intrusion into TeamViewer (2024)

German technology company TeamViewer SE reported on June 28 2024 its corporate IT network had been compromised by Cozy Bear.[56] It stated that user data and its TeamViewer remote desktop software product was unaffected.[57]

See also

External links

Notes and References

  1. Web site: INTERNATIONAL SECURITY AND ESTONIA . 2018 . www.valisluureamet.ee . 2020-12-15 . 2023-02-02 . https://web.archive.org/web/20230202133006/https:/www.valisluureamet.ee/doc/raport/2018-en.pdf . dead .
  2. Russian Cyber Units . Andrew S. Bowen . January 4, 2021 . . 1 . July 25, 2021 . https://web.archive.org/web/20210805173434/https://crsreports.congress.gov/product/pdf/IF/IF11718 . August 5, 2021 . live.
  3. Web site: Zettl-Schabath . Kerstin . Bund . Jakob . Gschwend . Timothy . Borrett . Camille . 23 February 2023 . Advanced Threat Profile - APT29 . live . https://web.archive.org/web/20230419095844/https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf . 19 April 2023 . 3 October 2024 . European Repository of Cyber Incidents.
  4. Web site: 2018 . International Security and Estonia . dead . https://web.archive.org/web/20230202133006/https:/www.valisluureamet.ee/doc/raport/2018-en.pdf . 2 February 2023 . 3 October 2024 . Estonian Foreign Intelligence Service.
  5. Web site: Alperovitch. Dmitri. Bears in the Midst: Intrusion into the Democratic National Committee. CrowdStrike Blog. 27 September 2016. 24 May 2019. https://web.archive.org/web/20190524090240/https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/. live.
  6. News: Who Is COZY BEAR?. CrowdStrike. 19 September 2016. 15 December 2016. 15 December 2020. https://web.archive.org/web/20201215193550/https://www.crowdstrike.com/blog/who-is-cozy-bear/. dead.
  7. Web site: F-Secure Study Links CozyDuke to High-Profile Espionage. Press Release. 6 January 2017. 30 April 2015. 7 January 2017. https://web.archive.org/web/20170107103344/https://www.f-secure.com/en/web/press_global/news-clippings/-/journal_content/56/1075444/1229794. live.
  8. Web site: Cyberattacks Linked to Russian Intelligence Gathering. F-Secure. 6 January 2017. Press Release. 17 September 2015. 7 January 2017. https://web.archive.org/web/20170107105110/https://www.f-secure.com/en/web/press_global/news/news-archive/-/journal_content/56/1075444/1360080?p_p_auth=M8oOtW07&refererPlid=910425. live.
  9. Web site: Dukes Archives . 2024-10-03 . Volexity . en-US.
  10. News: Weise . Karen . Microsoft Executives' Emails Hacked by Group Tied to Russian Intelligence . The New York Times . January 19, 2024 . January 20, 2024 . January 20, 2024 . https://web.archive.org/web/20240120012259/https://www.nytimes.com/2024/01/19/technology/microsoft-executive-emails-hacked.html . live .
  11. Web site: Midnight Blizzard . 2024-10-03 . www.microsoft.com . en-US.
  12. Web site: 2015-04-21 . The CozyDuke APT . 2024-10-03 . securelist.com . en-US.
  13. Web site: UNC2452 Merged into APT29 Russia-Based Espionage Group . 2024-10-03 . Google Cloud Blog . en-US.
  14. Web site: Team . Microsoft Defender Security Research . 2018-12-03 . Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers . 2024-10-03 . Microsoft Security Blog . en-US.
  15. News: 13 July 2015 . "Forkmeiamfamous": Seaduke, latest weapon in the Duke armory . live . https://web.archive.org/web/20161214172949/https://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory . 14 December 2016 . 15 December 2016 . Symantec Security Response.
  16. News: Harding . Luke . Ganguly . Manisha . Sabbagh . Dan . 2023-03-30 . 'Vulkan files' leak reveals Putin's global and domestic cyberwarfare tactics . 2024-10-03 . The Guardian . en-GB . 0261-3077.
  17. Web site: CosmicDuke is a newer version of the MiniDuke backdoor . 2024-10-03 . APT Kaspersky Securelist . en.
  18. Web site: The Case of The Modified Binaries . 2024-10-03 . Leviathan Security Group - Penetration Testing, Security Assessment, Risk Advisory . en-US.
  19. Web site: 14 November 2014 . OnionDuke: APT Attacks Via the Tor Network . 2024-10-03 . F-Secure Labs.
  20. News: FireEye. HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. 7 August 2015. 9 July 2015. 23 March 2019. https://web.archive.org/web/20190323094248/https://www.fireeye.com/blog/threat-research/2015/07/hammertoss_stealthy.html. dead.
  21. News: Kaspersky Lab's Global Research & Analysis Team. Miniduke is back: Nemesis Gemina and the Botgen Studio. Securelist. 3 July 2014. 19 May 2020. 12 May 2020. https://web.archive.org/web/20200512211020/https://securelist.com/miniduke-is-back-nemesis-gemina-and-the-botgen-studio/64107/. live.
  22. Web site: June 2024 . Threat Profile: APT29 . 3 October 2024 . Blackpoint Cyber.
  23. Web site: Baumgartner. Kurt. Raiu. Costin. The CozyDuke APT. Securelist. 21 April 2015. 19 May 2020. 30 January 2018. https://web.archive.org/web/20180130091223/https://securelist.com/the-cozyduke-apt/69731/. live.
  24. News: MiniDuke relation 'CozyDuke' Targets White House. Threat Intelligence Times. 27 April 2015. 15 December 2016. https://web.archive.org/web/20180611124919/http://threatintelligencetimes.com/2015/04/27/miniduke-relation-cozyduke-targets-white-house/. 11 June 2018. dead.
  25. News: Satter . Raphael . Corder . Mike . January 26, 2018 . Report: Dutch spies caught Russian hackers on tape . live . https://web.archive.org/web/20241002190320/https://apnews.com/article/ef3b036949174a9b98d785129a93428b . 2 October 2024 . 3 October 2024 . AP News.
  26. News: Noack . Rick . The Dutch were a secret U.S. ally in war against Russian hackers, local media reveal . . January 26, 2018 . February 15, 2023 . January 26, 2018 . https://web.archive.org/web/20180126143612/https://www.washingtonpost.com/news/worldviews/wp/2018/01/26/dutch-media-reveal-country-to-be-secret-u-s-ally-in-war-against-russian-hackers/ . live .
  27. News: Kube. Courtney. Russia hacks Pentagon computers: NBC, citing sources. 7 August 2015. 7 August 2015. 8 August 2019. https://web.archive.org/web/20190808014900/https://www.cnbc.com/2015/08/06/russia-hacks-pentagon-computers-nbc-citing-sources.html. live.
  28. News: Starr. Barbara. Official: Russia suspected in Joint Chiefs email server intrusion. 7 August 2015. 7 August 2015. 8 August 2019. https://web.archive.org/web/20190808014850/https://edition.cnn.com/2015/08/05/politics/joint-staff-email-hack-vulnerability/. live.
  29. News: 22 September 2016 . Bear on bear . live . https://web.archive.org/web/20170520234836/http://www.economist.com/news/united-states/21707574-whats-worse-being-attacked-russian-hacker-being-attacked-two-bear-bear . 20 May 2017 . 14 December 2016 . The Economist.
  30. News: Ward. Vicky. Vicky Ward. The Man Leading America's Fight Against Russian Hackers Is Putin's Worst Nightmare. Esquire. October 24, 2016. December 15, 2016. January 26, 2018. https://web.archive.org/web/20180126114937/http://www.esquire.com/news-politics/a49902/the-russian-emigre-leading-the-fight-to-protect-america/. live.
  31. Web site: PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs . Volexity . November 9, 2016 . December 14, 2016 . December 20, 2016 . https://web.archive.org/web/20161220120256/https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/ . live .
  32. Web site: February 3, 2017 . Norge utsatt for et omfattende hackerangrep . live . https://web.archive.org/web/20170205101019/https://www.nrk.no/norge/norge-utsatt-for-et-omfattende-hackerangrep-1.13358988 . February 5, 2017 . February 4, 2017 . NRK.
  33. News: Stanglin. Doug. Norway: Russian hackers hit spy agency, defense, Labour party. USA Today. February 3, 2017. en. August 26, 2017. April 5, 2017. https://web.archive.org/web/20170405000138/https://www.usatoday.com/story/news/2017/02/03/norway-russian-hackers-hit-spy-agency-defense-labour-party/97441782/. live.
  34. News: Modderkolk. Huib. Russen faalden bij hackpogingen ambtenaren op Nederlandse ministeries. De Volkskrant. February 4, 2017. nl-NL. February 4, 2017. February 4, 2017. https://web.archive.org/web/20170204031543/http://www.volkskrant.nl/tech/russische-hackers-probeerden-binnen-te-dringen-bij-ministerie-algemene-zaken~a4457869/. live.
  35. News: Cluskey. Peter. Dutch opt for manual count after reports of Russian hacking. The Irish Times. February 3, 2017. February 4, 2017. February 3, 2017. https://web.archive.org/web/20170203184708/http://www.irishtimes.com/news/world/europe/dutch-opt-for-manual-count-after-reports-of-russian-hacking-1.2962777. live.
  36. Web site: Operation Ghost: The Dukes aren't back – they never left . ESET Research . October 17, 2019 . February 8, 2020 . March 11, 2020 . https://web.archive.org/web/20200311005008/https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/ . live .
  37. Web site: NSA Teams with NCSC, CSE, DHS CISA to Expose Russian Intelligence Services Targeting COVID . National Security Agency Central Security Service . 25 July 2020 . 11 December 2020 . https://web.archive.org/web/20201211185159/https://www.nsa.gov/news-features/press-room/Article/2275378/nsa-teams-with-ncsc-cse-dhs-cisa-to-expose-russian-intelligence-services-target/ . dead .
  38. Web site: CSE Statement on Threat Activity Targeting COVID-19 Vaccine Development – Thursday, July 16, 2020 . cse-cst.gc.ca . Communications Security Establishment . 16 July 2020 . 14 July 2020 . 16 July 2020 . https://web.archive.org/web/20200716200441/https://cse-cst.gc.ca/en/media/2020-07-16 . live .
  39. News: James. William. Russia trying to hack and steal COVID-19 vaccine data, says Britain. 16 July 2020. Reuters UK. 16 July 2020. 17 July 2020. https://web.archive.org/web/20200717064946/https://uk.reuters.com/article/uk-health-coronavirus-cyber/russia-trying-to-hack-and-steal-covid-19-vaccine-data-says-britain-idUKKCN24H232. dead.
  40. Web site: UK and allies expose Russian attacks on coronavirus vaccine development. 16 July 2020. 16 July 2020. National Cyber Security Centre. 16 July 2020. https://web.archive.org/web/20200716165540/https://www.ncsc.gov.uk/news/uk-and-allies-expose-russian-attacks-on-coronavirus-vaccine-development. live.
  41. Web site: FireEye, a Top Cybersecurity Firm, Says It Was Hacked by a Nation-State . The New York Times . December 8, 2020 . David E. . Sanger . Nicole . Perlroth . December 15, 2020 . December 15, 2020 . https://web.archive.org/web/20201215184304/https://www.nytimes.com/2020/12/08/technology/fireeye-hacked-russians.html . live .
  42. Web site: US cybersecurity firm FireEye says it was hacked by foreign government. Guardian staff and. agencies. December 9, 2020. the Guardian. December 15, 2020. December 16, 2020. https://web.archive.org/web/20201216014233/https://www.theguardian.com/technology/2020/dec/08/fireeye-hack-cybersecurity-theft. live.
  43. Web site: Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. FireEye. 2020-12-15. 2020-12-15. https://web.archive.org/web/20201215110129/https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html. live.
  44. Web site: Security Advisory | SolarWinds. www.solarwinds.com. 2020-12-15. 2020-12-15. https://web.archive.org/web/20201215101523/https://www.solarwinds.com/securityadvisory. live.
  45. Web site: cyber.dhs.gov - Emergency Directive 21-01. cyber.dhs.gov. 13 December 2020. 15 December 2020. 15 December 2020. https://web.archive.org/web/20201215153142/https://cyber.dhs.gov/ed/21-01/. live.
  46. Web site: SEC filings: SolarWinds says 18,000 customers were impacted by recent hack. Catalin. Cimpanu. ZDNet. 2020-12-15. 2020-12-15. https://web.archive.org/web/20201215101510/https://www.zdnet.com/article/sec-filings-solarwinds-says-18000-customers-are-impacted-by-recent-hack/. live.
  47. News: Nakashima. Ellen. Timberg. Craig. Russian government hackers are behind a broad espionage campaign that has compromised U.S. agencies, including Treasury and Commerce. en-US. Washington Post. 2020-12-14. 0190-8286. 2020-12-13. https://web.archive.org/web/20201213220635/https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html. live.
  48. Web site: Important steps for customers to protect themselves from recent nation-state cyberattacks. 14 December 2020. 16 December 2020. 20 December 2020. https://web.archive.org/web/20201220053325/https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/. live.
  49. News: Goodin. Dan. Timberg. ~18,000 organizations downloaded backdoor planted by Cozy Bear hackers. en-US. Ars Technica. 2020-12-15. 2020-12-16. https://web.archive.org/web/20201216194610/https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/. live.
  50. News: Sanger . David E. . 2020-12-13 . Russian Hackers Broke Into Federal Agencies, U.S. Officials Suspect . live . https://web.archive.org/web/20201213231542/https://www.nytimes.com/2020/12/13/us/politics/russian-hackers-us-government-treasury-commerce.html . 2020-12-13 . 2021-10-03 . The New York Times . en-US . 0362-4331.
  51. Web site: Russia 'Cozy Bear' Breached GOP as Ransomware Attack Hit . 6 July 2021 . Turton . William . Jacobs . Jennifer . . 7 July 2021 . 6 July 2021 . https://web.archive.org/web/20210706235320/https://www.bloomberg.com/news/articles/2021-07-06/russian-state-hackers-breached-republican-national-committee . live .
  52. Web site: Russian hackers reportedly attacked GOP computer systems . 6 July 2021 . Campbell . Ian Carlos . . 7 July 2021 . 7 July 2021 . https://web.archive.org/web/20210707000012/https://www.theverge.com/2021/7/6/22565779/rnc-breach-russian-hackers-cozy-bear . live .
  53. Web site: Nafisi . Ramin . 2021-09-27 . FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor . 2024-10-03 . Microsoft Security Blog . en-US.
  54. Web site: MagicWeb: NOBELIUM's post-compromise trick to authenticate as anyone . Microsoft Security Blog . Microsoft . 26 August 2022 . 24 August 2022 . 26 August 2022 . https://web.archive.org/web/20220826003234/https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/ . live .
  55. News: Hackers breached Microsoft to find out what Microsoft knows about them. Techcrunch. 19 January 2024. 22 January 2024. Lorenzo. Franceschi-Bicchierai. 20 January 2024. https://archive.today/20240120085213/https://techcrunch.com/2024/01/19/hackers-breached-microsoft-to-find-out-what-microsoft-knows-about-them/. live.
  56. News: Teamviewer accuses Russia-linked hackers of cyberattack. Reuters. 28 June 2024. 30 June 2024.
  57. Web site: Kunz . Christopher . TeamViewer-Angriff: Die Spur führt nach Russland . . 2024-06-28 . 2024-10-02 . de.

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "Cozy Bear".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2025, A B Cryer, All Rights Reserved. Cookie policy.