APT29
Nation-state Espionage Russia Dormant
Aliases: Cozy Bear · Nobelium · Midnight Blizzard · The Dukes · Cozy Duke · UNC2452 · Cloaked Ursa
Also seen as: NOBELIUM
- Mentions
- 1
- First seen
- 22 May 2026
- Last seen
- 22 May 2026
Relevant to you · Relevant
- Threat focus:
- espionage / aptindustrial / ot espionage
- Sector / region:
- Manufacturing
Origin
Russia — Russian foreign intelligence (SVR)
Profile
APT29, also known as Cozy Bear, is a nation-state actor. Recent reporting highlights the use of ROADtools for cloud-based operations. Tactics focus on compromising cloud identities.
Affected vendors
Microsoft
Associated malware / tools
ROADtools