Cozy Bear

Intrusion campaigns

Cozy Bear has been observed targeting and compromising organizations and foreign governments worldwide (including Russian opposition countries such as NATO and Five Eyes) and the commercial sector (notably financial, manufacturing, energy and telecom). Targeting also included South America, and Asia (notably China and South Korea). The United States is a frequent target, including the 2016 Clinton campaign, political parties (DNC, RNC), various executive agencies, the State Department and the White House.

Intrusion into U.S. government agencies (2014)

Cozy Bear malware was discovered on a Washington, D.C.–based private research institute in March 2014. Using compromised accounts at that organization, they sent phishing emails to other US government targets leveraging a malicious Flash file purporting to show "funny office monkeys". By July the group had compromised several government networks.

Exposure by Dutch intelligence (2014)

In the summer of 2014, the Dutch General Intelligence and Security Service (AIVD) infiltrated the camera network used by Cozy Bear's physical office. This footage confirmed targeting of the US Democratic Party, State Department and White House and may have been used in the FBI investigation into 2016 Russian election interference.

Intrusion into Pentagon email servers (2015)

In August 2015 Cozy Bear was linked to a spear phishing campaign against the Pentagon, which the resulting investigation shut down the entire Joint Chiefs of Staff unclassified email system.

Intrusion into the U.S. Democratic National Committee (2016)

Cozy Bear and fellow Russian hacking group Fancy Bear (likely the GRU) were identified as perpetuating the Democratic National Committee intrusion. While the two groups were both present in the DNC's servers at the same time, they appeared to operate independently. Further confirming their independent operations, computer forensics determined that Fancy Bear had only compromised the DNC for a few weeks while Cozy Bear had done so for over a year.

Attempted intrusion into US think tanks and NGOs (2016)

After the 2016 United States presidential election, Cozy Bear was linked to spear phishing campaigns against multiple U.S.-based think tanks and non-governmental organizations (NGOs) related to national security, defense, international affairs, public policy, and European and Asian studies. Some emails were sent from compromised Harvard accounts.

Attempted intrusion into Norwegian government (2017)

On 3 February 2017, the Norwegian Police Security Service (PST) reported that Cozy Bear had launched spear phishing campaigns against at least nine individuals across the Ministry of Defence, Ministry of Foreign Affairs, and the Labour Party in January 2017. Other targets included the Norwegian Radiation Protection Authority and members of the Norwegian Police Security Service, including section chief Arne Christian Haugstøyl. Norwegian Prime Minister Erna Solberg called the acts "a serious attack on our democratic institutions."

Attempted intrusion into Dutch ministries (2016-2017)

Reported in February 2017, both Cozy Bear and Fancy Bear had been attempting to compromise into Dutch ministries since 2016. Targets included the Ministry of General Affairs. Then-head of the Dutch intelligence service AIVD Rob Bertholee, stated on EenVandaag television that the Russian intrusion had targeted government documents.

In response, Dutch Minister of the Interior and Kingdom Relations Ronald Plasterk announced that the March 2017 Dutch general election would be counted by hand.

Duke variants and Operation Ghost (2019)

In 2019 ESET reported that three malware variants had been attributed to Cozy Bear: PolyglotDuke, RegDuke and FatDuke. The malware had reportedly improved its anti-analysis methods and had been observed being used in intrusion campaigns dubbed "Operation Ghost".

Attempted theft of COVID-19 vaccine data (2020)

In July 2020 Five Eyes intelligence agencies NSA, NCSC and CSE reported that Cozy Bear had attempted to obtain COVID-19 vaccine data via intrusion campaigns.

SUNBURST malware supply chain attack (2020)

On 8 December 2020, U.S. cybersecurity firm FireEye disclosed that their internal tools had been stolen by a nation-state. Later investigations implicated an internal compromise of software deployments of SolarWinds Orion IT management product to distribute a trojan that FireEye dubbed SUNBURST. SolarWinds later confirmed that it had been compromised by a foreign nation state. and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive that U.S. government agencies rebuild the affected software from trusted sources. It also attributed the intrusion campaign to the Russian SVR. Approximately 18,000 SolarWinds clients were vulnerable to the compromised Orion software. Estimates based on DNS C2 activity indicate that around one percent of these SolarWinds clients were selected for stage-two operations, where the perpetrators installed backdoors to remotely control the vulnerable SolarWinds installations. The Washington Post cited anonymous sources that attributed Cozy Bear as the perpetrator.

According to Microsoft, the hackers compromised SolarWinds code signing certificates and deployed a backdoor that allowed impersonation of a target's user account via a malicious Security Assertion Markup Language definition.

Intrusion into U.S. civilian agencies (2020)

On 20 December 2020 the U.S. Government reported that Cozy Bear was responsible for compromising the networks of civilian agencies Department of Commerce and Department of the Treasury.

Intrusion into the U.S. Republican National Committee (2021)

In July 2021, Cozy Bear breached systems of the Republican National Committee. Officials said they believed the attack to have been conducted through Synnex, a compromised third-party IT vendor.()

Active Directory authentication bypasses (2021–2022)

In 2021 Microsoft reported that Cozy Bear was leveraging the "FoggyWeb" tool to dump authentication tokens from compromised Active Directory instances. This was performed after they gained access to a machine on the target network and were able to obtain AD administrator credentials. On 24 August 2022, Microsoft reported the group has deployed a similar tool "MagicWeb" to bypass user authentication on affected Active Directory Federated Services servers.

Intrusion into Microsoft (2024)

In January 2024, Microsoft reported having recently discovered and ended a breach beginning the previous November of the email accounts of their senior leadership and other employees in the legal and cybersecurity teams using a "password spray", a form of brute-force attack. This hack conducted by Midnight Blizzard appears to have aimed to find what the company knew about the hacking operation.

Intrusion into TeamViewer (2024)

German technology company TeamViewer SE reported on June 28, 2024, its corporate IT network had been compromised by Cozy Bear. It stated that user data and its TeamViewer remote desktop software product was unaffected.