Cozy bear: origins and tactics

Welcome reader to a 🔍 free deep dive. No paywall, just insights.

Brought to you by:

👉 Cypago - Cyber governance, risk management, and continuous control monitoring in a single platform

🤖 Akeyless – The unified secrets and non-human identity platform built for scale, automation, and zero-trust security

🧠 Ridge Security - The AI-powered offensive security validation platform

Forwarded this email? Join 70,000 weekly readers by signing up now.

#OpenToWork? Try our AI Resume Builder to boost your chances of getting hired!

—

Get lifetime access to our deep dives, weekly cyber intel podcast report, premium content, AI Resume Builder, and more — all for just $799. Corporate plans are now available too.

Executive Summary

Cozy Bear (also known as APT29, Midnight Blizzard, The Dukes, and Nobelium) is a sophisticated Russian state-sponsored advanced persistent threat group linked to Russia's Foreign Intelligence Service (SVR). Active since at least 2008, this group has conducted numerous high-profile cyber espionage campaigns against governments, diplomatic entities, think tanks, and critical infrastructure across the globe.

Their most notorious operations include the 2016 Democratic National Committee (DNC) breach, the 2020 SolarWinds supply chain attack, and more recently, targeted campaigns against diplomatic entities in early 2025. Characterized by their stealth, persistence, and advanced toolset, Cozy Bear represents a significant and evolving cyber threat to national security, intellectual property, and strategic institutions worldwide.

1. Historical Origins and Attribution

Early Activities (2008-2014)

Cozy Bear's operations can be traced back to approximately 2008, though some intelligence suggests activity as early as 2004. The group initially deployed malware referencing Chechnya, indicating early alignment with Russian geopolitical interests. By 2009, they had expanded their focus to Western targets, particularly NATO and U.S. political-military affairs.

The first documented malware family attributed to Cozy Bear, known as "The Dukes," targeted Chechen separatists and Western governments. This early activity established patterns that would become their signature: sophisticated tradecraft, stealth, and alignment with Russian intelligence priorities.

Attribution to Russian Intelligence

Multiple intelligence agencies and cybersecurity firms have attributed Cozy Bear to Russia's Foreign Intelligence Service (SVR):

• In 2016, the U.S. intelligence community officially attributed the DNC hack to Russian intelligence services

• A joint advisory by the UK's NCSC, Canada's CSE, and the U.S. NSA in 2020 concluded that APT29 is "almost certainly" part of Russian intelligence

• The United States formally named the SVR as responsible for the SolarWinds operation in April 2021

While attribution is widely accepted among Western intelligence agencies, Russia has consistently denied involvement. Some cybersecurity researchers have noted occasional target overlaps suggesting potential coordination with FSB (Russian Federal Security Service), though the SVR remains the primary attribution.

The "Office Monkeys" Campaign (2014)

Cozy Bear gained significant notoriety following their 2014 "Office Monkeys" campaign targeting the U.S. State Department and White House unclassified email systems. This intrusion demonstrated their ability to infiltrate high-security environments and evade detection. NSA defenders described the effort to remove the attackers as "hand-to-hand combat," with Cozy Bear operators repeatedly reestablishing connections and showing unprecedented aggression in maintaining access.

This incident firmly established Cozy Bear as a premier threat actor and offered early evidence of their state-sponsored nature, given the resources and persistence displayed.

2. Technical Capabilities and Evolution

Malware Arsenal

Cozy Bear has continuously developed and deployed sophisticated malware toolsets:

Early Duke Family (2008-2016):

• MiniDuke: Windows backdoor first observed around 2013

• CosmicDuke: Information stealer with capabilities for persistence

• OnionDuke: Developed for lateral movement

• SeaDuke: Java-based backdoor used in the DNC hack

• CloudDuke: Command and control infrastructure leveraging cloud services

SolarWinds Campaign (2020):

• SUNBURST: Supply chain backdoor injected into SolarWinds Orion

• TEARDROP: Second-stage malware deployed on select high-value targets

• SUNSPOT: Build server compromise tool used to inject the backdoor

• GoldMax: Post-exploitation tool for cloud environments

Recent Developments (2022-2025):

• WINELOADER: Sophisticated backdoor observed in 2024-2025 diplomatic targeting

• GRAPELOADER: Initial-stage loader with enhanced anti-analysis capabilities

• Enhanced cloud-native attack tooling focusing on identity and access management exploitation

Their malware evolution demonstrates systematic investment in capability development and adaptation to defensive measures and changing technology landscapes.

Operational Techniques

Cozy Bear's tactics have evolved significantly over time, but several common operational patterns persist:

1. Initial Access Methods:

   • Spear-phishing with malicious attachments or links (primary method)

   • Supply chain compromises (SolarWinds)

   • Vulnerability exploitation in public-facing applications

2. Persistence Mechanisms:

   • Multiple backdoors deployed across target networks

   • Identity-based persistence (credential theft, token manipulation)

   • Legitimate cloud service abuse for command and control

3. Defense Evasion:

   • "Living off the land" techniques using legitimate administrative tools

   • Custom obfuscation of command and control traffic

   • Domain fronting and residential proxy usage for traffic blending

   • Heavy code obfuscation and runtime anti-analysis

4. Lateral Movement:

   • Credential harvesting and pass-the-hash techniques

   • Use of legitimate remote administration tools (RDP, WMI)

   • Exploitation of trust relationships between on-premises and cloud environments

Over time, Cozy Bear has shifted from primarily using custom malware to increasingly leveraging legitimate tools, services, and administrative functions to blend in with normal network traffic and evade detection.

MITRE ATT&CK Mapping

Cozy Bear's activities span numerous MITRE ATT&CK techniques, with significant representation across:

• Initial Access: Spear-phishing (T1566), Supply Chain Compromise (T1195)

• Execution: Command and Scripting Interpreter (T1059)

• Persistence: External Remote Services (T1133), Valid Accounts (T1078)

• Defense Evasion: Masquerading (T1036), Obfuscated Files (T1027)

• Credential Access: Kerberoasting (T1558), OS Credential Dumping (T1003)

• Discovery: Network Service Scanning (T1046), System Information Discovery (T1082)

• Lateral Movement: Remote Services (T1021), Lateral Tool Transfer (T1570)

• Collection: Data from Information Repositories (T1213)

• Command and Control: Encrypted Channel (T1573), Proxy (T1090)

• Exfiltration: Exfiltration Over C2 Channel (T1041)

Their extensive coverage across the MITRE framework demonstrates their comprehensive capabilities and adaptability.

3. Major Campaigns and Timeline (2014-2025)

DNC Breach (2015-2016)

Cozy Bear infiltrated the Democratic National Committee network in mid-2015, maintaining access for nearly a year. Security firm CrowdStrike identified their presence in spring 2016, discovering they had been operating simultaneously but separately from another Russian threat actor, APT28 (Fancy Bear), which is attributed to Russia's military intelligence (GRU).

While APT28/Fancy Bear was responsible for the subsequent public leaking of stolen documents, Cozy Bear had already been quietly collecting intelligence from the DNC for months. This incident highlighted Cozy Bear's focus on traditional espionage rather than the influence operations pursued by their GRU counterparts.

COVID-19 Vaccine Research Targeting (2020)

In July 2020, security agencies from the United Kingdom, United States, and Canada released a joint advisory warning that Cozy Bear was targeting organizations involved in COVID-19 vaccine development. The group deployed WellMess and WellMail malware against research institutions to steal intellectual property related to vaccine development.

This campaign demonstrated Cozy Bear's ability to rapidly align with evolving Russian intelligence priorities during a global crisis and showcased their deployment of previously unknown malware families.

SolarWinds Supply Chain Attack (2020-2021)

The SolarWinds operation represents Cozy Bear's most sophisticated and far-reaching campaign to date. The group compromised SolarWinds' build system to insert a backdoor (SUNBURST) into updates of the widely-used Orion IT monitoring platform. This Trojanized update was distributed to approximately 18,000 organizations worldwide between March and June 2020.

From these initial access points, Cozy Bear carefully selected high-value targets for further exploitation, including:

• At least nine U.S. federal agencies (including Treasury, Justice, and State Departments)

• Over 100 private companies

• Several foreign government networks

The operation remained undetected for months until discovered by FireEye (now Mandiant) in December 2020. This campaign demonstrated unprecedented scale, sophistication, and patience, with experts describing it as possibly "the largest and most sophisticated espionage attack in history."

Microsoft Corporate Breach (2023-2024)

In early 2024, Microsoft disclosed that Cozy Bear had infiltrated its corporate network in late 2023. The attackers utilized password spraying against a legacy non-MFA account to gain initial access, then escalated privileges to access the company's source code repositories and email accounts belonging to senior leadership and security teams.

This operation appeared specifically designed to gather intelligence about Microsoft's threat detection capabilities regarding Russian operations—essentially a counter-intelligence move against a major cybersecurity provider.

European Diplomatic Targeting (2024-2025)

In January 2025, security researchers identified a sustained Cozy Bear campaign targeting European diplomatic entities. The operation used sophisticated phishing techniques, masquerading as a European foreign ministry sending invitations to diplomatic events (particularly "wine tasting" events, hence the malware names).

The campaign delivered an initial-stage loader called GRAPELOADER which deployed an updated version of WINELOADER. This operation demonstrated Cozy Bear's continued focus on diplomatic intelligence gathering and their ongoing malware evolution.

4. Geopolitical Context and Strategic Objectives

Intelligence Collection Priorities

Cozy Bear's targeting aligns closely with traditional Russian foreign intelligence priorities:

1. Diplomatic and Political Intelligence: Targeting government agencies, embassies, and international organizations to gather information on policy positions, negotiations, and decision-making processes.

2. Strategic Technology Transfer: Targeting research institutions and high-technology firms to acquire intellectual property and scientific advances, as seen in the COVID-19 vaccine campaign.

3. Military and Defense Information: Collecting intelligence on NATO capabilities, defense planning, and military technologies.

4. Counter-Intelligence: Gathering information about Western intelligence operations and cybersecurity capabilities, exemplified by the Microsoft breach.

These priorities reflect the SVR's traditional intelligence collection mission, supporting Russian strategic decision-making and advancing its geopolitical interests.

Comparison with Other Russian APT Groups

Russia operates several distinct cyber threat groups with different missions, capabilities, and parent organizations:

APT28 (Fancy Bear): Attributed to Russian military intelligence (GRU), operates with more disruptive objectives, including hack-and-leak operations and election interference. While Cozy Bear focuses on quiet intelligence gathering, APT28 has demonstrated willingness to publicly expose stolen information for influence operations.

Sandworm Team: Another GRU-linked group responsible for destructive attacks like NotPetya and attacks on Ukraine's power grid. Unlike Cozy Bear's espionage focus, Sandworm conducts cyber warfare with destructive intent.

Turla (Snake): Attributed to Russia's FSB, focuses on sophisticated long-term espionage operations. While similar to Cozy Bear in mission, they operate with distinct tools and techniques.

Cozy Bear's operations are distinct in their patience, stealth, and focus on intelligence collection rather than disruption or destruction.

Evolution Amidst Geopolitical Tensions

Cozy Bear's activities have evolved alongside broader geopolitical developments:

• 2014-2016: Following Russia's annexation of Crimea and increased tensions with the West, Cozy Bear intensified operations against Western government targets.

• 2020-2022: During the COVID-19 pandemic and growing East-West tensions, the group conducted its most ambitious operations (SolarWinds, vaccine research targeting).

• 2022-2025: Following Russia's invasion of Ukraine and resulting international isolation, Cozy Bear has maintained aggressive intelligence collection against Western diplomatic and government targets, likely to inform Russian strategic decision-making in an increasingly polarized geopolitical landscape.

5. Defensive Considerations and Mitigations

Technical Defenses

Organizations can implement several measures to defend against Cozy Bear:

1. Identity and Access Management:

   • Enforce multi-factor authentication across all accounts

   • Implement least-privilege access policies

   • Monitor for identity-based attacks and anomalous authentication

   • Secure cloud identity systems and federation trusts

2. Network Security:

   • Deploy advanced email filtering with anti-phishing capabilities

   • Implement network segmentation to limit lateral movement

   • Monitor for unusual DNS patterns that may indicate command and control

   • Employ TLS inspection where possible to examine encrypted traffic

3. Endpoint Protection:

   • Deploy EDR solutions with behavioral analytics

   • Monitor for Living-Off-the-Land techniques

   • Implement application whitelisting where feasible

   • Maintain rigorous patching of internet-facing systems

4. Cloud Security:

   • Secure cloud identity systems and federation trusts

   • Implement strict OAuth application controls

   • Monitor for token manipulation and credential abuse

   • Deploy Cloud Security Posture Management solutions

Strategic Responses

Beyond technical defenses, organizations should consider strategic approaches:

1. Threat Intelligence Integration: Incorporate specific Cozy Bear indicators and TTPs into security monitoring.

2. Assume Breach Mentality: Given Cozy Bear's sophistication, organizations should operate under the assumption that prevention might fail and focus on detection and response.

3. Supply Chain Security: Implement rigorous vendor security assessments and software verification processes.

4. Workforce Awareness: Train employees to recognize sophisticated phishing attempts, particularly those targeted at high-value individuals.

5. Tabletop Exercises: Conduct response drills specifically modeling Cozy Bear tactics to prepare security teams.

6. Recent Developments and Future Outlook

Technical Evolution Trends

As of 2025, several trends are evident in Cozy Bear's technical evolution:

1. Cloud-Native Attack Chains: Increasing focus on compromising cloud identity systems and leveraging cloud services for persistence and lateral movement.

2. Anti-Analysis Techniques: Enhanced evasion mechanisms in malware like GRAPELOADER, making detection and analysis more challenging.

3. Supply Chain Focus: Following the success of SolarWinds, continued interest in compromising software supply chains for widespread access.

4. Counter-IR Tactics: Growing sophistication in detecting and evading incident response activities.

Future Threat Landscape

Looking forward, several factors will likely shape Cozy Bear's evolution:

1. Increased Resource Constraints: Western sanctions on Russia may impact resource availability, potentially leading to more focused targeting.

2. Defensive Adaptation: As defenders specifically harden against known Cozy Bear tactics, the group will likely continue to innovate.

3. Geopolitical Drivers: Ongoing tensions between Russia and the West will continue to shape intelligence collection priorities.

4. Zero-Day Exploitation: Acquisition and deployment of novel zero-day vulnerabilities will remain a critical capability.

5. AI Integration: Potential incorporation of AI/ML techniques for more sophisticated social engineering and defense evasion.

The group is expected to remain a premier cyber threat, continuing to evolve its capabilities while maintaining its core focus on intelligence collection.

7. Conclusion

Cozy Bear represents one of the most sophisticated and persistent cyber espionage threats in the current landscape. Their evolution from traditional malware operations to advanced supply chain compromises and cloud-focused attacks demonstrates their adaptability and resource backing.

Their activities reflect Russia's strategic intelligence priorities, focusing on diplomatic, defense, and technological intelligence to advance Russian interests. The group's attribution to the SVR aligns with its methodical, patient approach to intelligence gathering rather than the disruptive operations associated with military intelligence groups.

As of 2025, Cozy Bear remains highly active, with recent campaigns showing continued innovation in tactics and tooling. Their focus on diplomatic targets suggests an ongoing mission to gather foreign policy intelligence during a period of significant geopolitical tension.

For defenders, addressing the Cozy Bear threat requires a comprehensive approach combining technical controls, strategic preparation, and ongoing threat intelligence integration. Given their demonstrated persistence and resourcefulness, organizations within their targeting scope should prepare for sophisticated, long-term campaigns rather than opportunistic attacks.

The evolution of Cozy Bear over the past decade provides a case study in how state-sponsored threat actors adapt to changing technical landscapes and defensive measures while remaining focused on core intelligence collection missions. This pattern is likely to continue as geopolitical tensions persist and cyber operations remain a critical component of modern intelligence activities.

Stay safe, stay secure.

The CybersecurityHQ Team