{"id":494,"count":0,"description":"
\n
\n Year Established<\/span>\n
2018<\/div>\n <\/div>\n
\n Attribution<\/span>\n
Russia (SVR)<\/div>\n <\/div>\n
\n Motivation<\/span>\n
Espionage<\/div>\n <\/div>\n
\n Modus Operandi (MO)<\/span>\n
Supply chain attacks, OAuth abuse, cloud environment targeting, diplomatic and government espionage<\/div>\n <\/div>\n
\n Primary Aliases<\/span>\n
Nobelium, APT29 (partial overlap), Cozy Bear (historical), UNC2452, Dark Halo<\/div>\n <\/div>\n<\/div>\n

Midnight Blizzard, designated by Microsoft as the successor tracking name for Nobelium (and historically associated with the Cozy Bear\/APT29 cluster), represents the SVR's most sophisticated offensive cyber capability , a group responsible for some of the most consequential espionage operations in the history of cyberspace. While there is significant tracking overlap with APT29\/Cozy Bear, Midnight Blizzard\/Nobelium is typically used to refer specifically to the operational cluster responsible for the SolarWinds campaign and subsequent Microsoft-specific targeting.<\/p>\n

The group's most impactful known operation is the 2020 SolarWinds SUNBURST supply chain attack, in which malicious code was embedded into legitimate software updates distributed to approximately 18,000 organisations globally, granting Midnight Blizzard covert access to networks of the US Treasury Department, the Department of Homeland Security, the Pentagon, major defence contractors, and numerous Fortune 500 companies. The sophistication and patience of this operation , which involved months of preparation before deployment , marked a watershed moment in supply chain security awareness.<\/p>\n

Following SolarWinds, Midnight Blizzard evolved its focus toward cloud infrastructure, systematically targeting Microsoft 365 environments through exploitation of OAuth application permissions, stolen credentials, and token theft techniques. In January 2024, Microsoft disclosed that Midnight Blizzard had successfully compromised the email accounts of Microsoft's senior leadership team, including members of the cybersecurity and legal teams, exfiltrating internal correspondence related to Microsoft's own knowledge of the group's activities.<\/p>\n

Midnight Blizzard's consistent focus on understanding and subverting Western cybersecurity defences , including directly targeting cybersecurity firms and government agencies responsible for Russian threat actor attribution , demonstrates a strategic meta-objective of maintaining long-term access and intelligence advantage over adversaries who seek to expose and disrupt Russian cyber operations.<\/p>\n\n

Threat Mitigation and Strategic Hardening:<\/strong> Network defense against campaigns linked to Midnight Blizzard (Nobelium)<\/strong> requires continuous threat surface management, dark web monitoring for stolen employee credentials, and automated telemetry correlation. Organizations should reference our Cyber Risk Checker<\/a> and report critical indicators via Secure Drop<\/a>.<\/p>","link":"https:\/\/cyberasia.io\/actor\/midnight-blizzard-nobelium\/","name":"Midnight Blizzard (Nobelium)","slug":"midnight-blizzard-nobelium","taxonomy":"threat_actor","parent":0,"meta":[],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors\/494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/taxonomies\/threat_actor"}],"wp:post_type":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts?threat_actors=494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}