Latest APT29 news

TeamViewer links corporate cyberattack to Russian state hackers

RMM software developer TeamViewer says a Russian state-sponsored hacking group known as Midnight Blizzard is believed to be behind a breach of their corporate network this week.
- Lawrence Abrams
- June 28, 2024
- 10:42 AM
- 1
TeamViewer's corporate network was breached in alleged APT hack

The remote access software company TeamViewer is warning that its corporate environment was breached in a cyberattack yesterday, with a cybersecurity firm claiming it was by an APT hacking group.
- Lawrence Abrams
- June 27, 2024
- 02:29 PM
- 5
Russian hackers target German political parties with WineLoader malware

Researchers are warning that a notorious hacking group linked to Russia's Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions.
- Bill Toulas
- March 22, 2024
- 03:27 PM
- 1
Russian hackers shift to cloud attacks, US and allies warn

Members of the Five Eyes (FVEY) intelligence alliance warned today that APT29 Russian Foreign Intelligence Service (SVR) hackers are now switching to attacks targeting their victims' cloud services.
- Sergiu Gatlan
- February 26, 2024
- 12:31 PM
- 0
Microsoft reveals how hackers breached its Exchange Online accounts

Microsoft confirmed that the Russian Foreign Intelligence Service hacking group, which hacked into its executives' email accounts in November 2023, also breached other organizations as part of this malicious campaign.
- Bill Toulas
- January 26, 2024
- 10:23 AM
- 4
HPE: Russian hackers breached its security team’s email accounts

Hewlett Packard Enterprise (HPE) disclosed today that suspected Russian hackers known as Midnight Blizzard gained access to the company's Microsoft Office 365 email environment to steal data from its cybersecurity team and other departments.
- Lawrence Abrams
- January 24, 2024
- 04:50 PM
- 0
Russian hackers stole Microsoft corporate emails in month-long breach

Microsoft warned Friday night that some of its corporate email accounts were breached and data stolen by a Russian state-sponsored hacking group known as Midnight Blizzard.
- Lawrence Abrams
- January 19, 2024
- 07:02 PM
- 5
CISA: Russian hackers target TeamCity servers since September

CISA and partner cybersecurity agencies and intelligence services warned that the APT29 hacking group linked to Russia's Foreign Intelligence Service (SVR) has been targeting unpatched TeamCity servers in widespread attacks since September 2023.
- Sergiu Gatlan
- December 13, 2023
- 01:02 PM
- 0
Russian hackers use Ngrok feature and WinRAR exploit to attack embassies

After Sandworm and APT28 (known as Fancy Bear), another state-sponsored Russian hacker group, APT29, is leveraging the CVE-2023-38831 vulnerability in WinRAR for cyberattacks.
- Ionut Ilascu
- November 19, 2023
- 11:14 AM
- 1
Russian hackers target govt orgs in Microsoft Teams phishing attacks

Microsoft says a hacking group tracked as APT29 and linked to Russia's Foreign Intelligence Service (SVR) targeted dozens of organizations worldwide, including government agencies, in Microsoft Teams phishing attacks.
- Sergiu Gatlan
- August 02, 2023
- 03:52 PM
- 2
Russian state hackers lure Western diplomats with BMW car ads

The Russian state-sponsored hacking group 'APT29' (aka Nobelium, Cloaked Ursa) has been using unconventional lures like car listings to entice diplomats in Ukraine to click on malicious links that deliver malware.
- Bill Toulas
- July 12, 2023
- 03:01 PM
- 1
Russian hackers linked to widespread attacks targeting NATO and EU

Poland's Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29 state-sponsored hackers, part of the Russian government's Foreign Intelligence Service (SVR), to widespread attacks targeting NATO and European Union countries.
- Sergiu Gatlan
- April 13, 2023
- 10:27 AM
- 2
Microsoft: Russian malware hijacks ADFS to log in as anyone in Windows

Microsoft has discovered a new malware used by the Russian hacker group APT29 (a.k.a. NOBELIUM, Cozy Bear) that enables authentication as anyone in a compromised network.
- Bill Toulas
- August 25, 2022
- 12:36 PM
- 1
Russian APT29 hackers abuse Azure services to hack Microsoft 365 users

The state-backed Russian cyberespionage group Cozy Bear has been particularly prolific in 2022, targeting Microsoft 365 accounts in NATO countries and attempting to access foreign policy information.
- Bill Toulas
- August 19, 2022
- 11:10 AM
- 0
Russian SVR hackers use Google Drive, Dropbox to evade detection

State-backed hackers part of Russia's Federation Foreign Intelligence Service (SVR) have switched, for the first time, to using legitimate cloud storage services such as Google Drive to evade detection.
- Sergiu Gatlan
- July 19, 2022
- 08:35 AM
- 0
Ransomware, hacking groups move from Cobalt Strike to Brute Ratel

Hacking groups and ransomware operations are moving away from Cobalt Strike to the newer Brute Ratel post-exploitation toolkit to evade detection by EDR and antivirus solutions.
- Lawrence Abrams
- July 06, 2022
- 01:32 PM
- 5
Russian hackers compromise embassy emails to target governments

Security analysts have uncovered a recent phishing campaign from Russian hackers known as APT29 (Cozy Bear or Nobelium) targeting diplomats and government entities.
- Bill Toulas
- May 01, 2022
- 11:06 AM
- 0
Russian APT29 hackers' stealthy malware undetected for years

Hackers associated with the Russian Federation Foreign Intelligence Service (SVR) continued their incursions on networks of multiple organizations after the SolarWinds supply-chain compromise using two recently discovered sophisticated threats.
- Ionut Ilascu
- January 27, 2022
- 09:23 AM
- 0
Microsoft: Russian SVR hacked at least 14 IT supply chain firms since May

Microsoft says the Russian-backed Nobelium threat group behind last year's SolarWinds hack is still targeting the global IT supply chain, with 140 resellers and technology service providers attacked and at least 14 breached since May 2021.
- Sergiu Gatlan
- October 25, 2021
- 04:37 AM
- 0
New Tomiris backdoor likely developed by SolarWinds hackers

Kaspersky security researchers have discovered a new backdoor likely developed by the Nobelium hacking group behind last year's SolarWinds supply chain attack.
- Sergiu Gatlan
- September 29, 2021
- 12:09 PM
- 0