Midnight Blizzard
High ConfidenceCritical ThreatAPT29 • NOBELIUM • The Dukes • Cozy Bear • Dark Halo • StellarParticle +1 more
Midnight Blizzard is a highly sophisticated Russian cyber espionage group attributed by the US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR). Active since at least 2008, the group is one of Russia's longest-running and most capable APT operations, responsible for some of the most significant cyber intrusions in history including the 2020 SolarWinds supply chain compromise. The group has demonstrated exceptional adaptability, evolving its tactics to target cloud-based infrastructure as organizations modernize their systems. In 2024, Midnight Blizzard gained significant attention for breaching Microsoft's corporate email system and accessing executive communications and source code, as well as compromising Hewlett Packard Enterprise's cloud-based email.
Midnight Blizzard is a highly sophisticated Russian cyber espionage group attributed by the US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR). Active since at least 2008, the group is one of Russia's longest-running and most capable APT operations, responsible for some of the most significant cyber intrusions in history including the 2020 SolarWinds supply chain compromise. The group has demonstrated exceptional adaptability, evolving its tactics to target cloud-based infrastructure as organizations modernize their systems. In 2024, Midnight Blizzard gained significant attention for breaching Microsoft's corporate email system and accessing executive communications and source code, as well as compromising Hewlett Packard Enterprise's cloud-based email.
Target Sectors
Target Regions
Attributed to SVR (Foreign Intelligence Service) (Russia). Attribution confidence: High.
Future Outlook
Midnight Blizzard remains one of the most capable and persistent threat actors globally. The group continues to adapt its tactics to target cloud infrastructure.
First observed APT29/Cozy Bear activity
DNC breach attributed to APT29
SolarWinds supply chain compromise discovered
Microsoft corporate email breach disclosed