Threat Actor ProfileCozy Bear

2012-2019

2016

In tandem with their GRU colleagues of APT28, also known as FancyBear, Cozy Bear conducted the 2016 hack of the Democratic National Committee (DNC) in the United States. The attack was a new attempt to undermine the legitimacy of the US presidential election or even swing the outcome in Russia’s favour. Russia’s preferred candidate was Donald Trump, who held a milder stance towards Putin than his opponent, Hillary Clinton. The threat actors obtained large amounts of sensitive data from the DNC servers and allegedly gave it to WikiLeaks, which in turn published over 20,000 stolen emails.[9]The hack had far-reaching consequences, which impacted Hillary Clinton’s chances of securing a presidential victory. Even though both the SVR and the GRU were involved, only 12 officers of the latter agency were officially indicted in a special investigation looking into the matter.[10]

For more information on APT28, see our profile of the group.

2020

During the global COVID-19 pandemic, Russia was developing its own vaccine. In support of this effort, Cozy Bear’s cyber capabilities were leveraged, targeting several universities and large pharmaceutical companies in the West.[11] The hackers exploited several known vulnerabilities in their attacks, such as CVE-2019-19781; CVE-2019-11510; CVE-2018-13379 or CVE-2019-9670.[12] A collaboration between Oxford University and AstraZeneca, a British-Swedish pharmaceutical and biotechnology firm, expressed their concern about the Russian vaccine program showing some close similarities to theirs. It is likely the Oxford-AstraZeneca collaboration was the main target of the hacking campaign, but more victims cannot be ruled out.[13]

2019-2021

The sophistication of Cozy Bear truly manifested in their magnum opus: the hack of the IT vendor SolarWinds. In December 2020, FireEye cybersecurity company was conducting an investigation into a breach of their own infrastructure. During the investigation, their security team made a curious discovery: the breach did not originate within their own network but rather from their IT supply chain. The researchers identified that the initial entry point could be traced back to a software product called 'Orion' developed by SolarWinds, a software company. Through a software update, the Orion IT management software installed a hidden access point, known as a backdoor, into the networks where it was deployed. FireEye, upon making this discovery, named the malware 'SUNBURST'.[14]

In the subsequent weeks, the unprecedented scale of this attack came to light . Numerous prominent companies and organizations found themselves blindsided by the vulnerability exploited in the software of their trusted vendor. Notably affected were industry leaders such as Microsoft, Intel, and Cisco, who are usually expected to have the highest level of security measures in place. It became apparent that more than 18,000 clients of SolarWinds had installed the compromised SUNBURST update. Other significant victims included various U.S. government departments, such as Homeland Security, Commerce, and Treasury. Even the National Nuclear Security Administration, responsible for safeguarding the U.S. nuclear stockpile, was unable to repel the attack.[15]

The hack had been going on since 2019, indicating that Cozy Bear has the ability to conduct long-term strategic espionage operations, which is something only a handful of threat actors can do on this scale. It was thought by many that the SolarWinds breach was unpreventable as the hackers used previously unknown and undetectable techniques. However, Hunt & Hackett challenges that idea in this article, detailing how even undetectable attacks can be detected.

2022-2023

Naturally, the years of 2022-2023 have been marked with activities related to Ukraine. The latest attacks include a credential-stealing campaign against various governmental and nongovernmental organisations identified in June[16] and a phishing campaign targeting personnel of various Ministries of Foreign Affairs of NATO aligned countries. In this latter campaign, Cozy Bear was impersonating the German embassy while the attached PDF file contained malicious payload.[17] The most innovative approach in recent months, however, has been Cozy Bear’s BMW lure in Kyiv. They sent car advertisement pamphlets to diplomats’ email addresses in Ukraine, supposedly from a Polish diplomat preparing to leave the country. When the target clicked on the link to see more high-quality photos, they would be directed to a page that delivers malicious ISO payloads.[18] The exact impact of these campaigns has not been reported, but it is clear that the group takes advantage of the social and political consequences created by Russia itself.