Threat actor
Midnight Blizzard
Russia
Tracked by CyberSIXT since 1 Sep 2025
- Articlesall time
- 4
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
4 articles from 4 outlets since 1 Sep 2025; the latest 45 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 11 Sep · 08:59 UTC | SecurityWeek | Russian Hackers Used Claude to Evade Detection in Spy Campaign |
| Mon 3 Aug · 14:51 UTC | Infosecurity | APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates |
| Fri 31 Jul · 21:50 UTC | Microsoft | Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch |
| Mon 1 Sep 2025 · 19:15 UTC | BleepingComputer | Amazon disrupts Russian APT29 hackers targeting Microsoft 365 |
) : ""}
Names and sources
- UNC2452
- CyberSIXT coverage, Malpedia, MISP Galaxy
- APT29
- Malpedia
- Cozy Bear
- Malpedia
- DarkHalo
- Malpedia, MISP Galaxy
- Midnight Blizzard
- Malpedia, MISP Galaxy
- NOBELIUM
- Malpedia, MISP Galaxy
- Solar Phoenix
- Malpedia, MISP Galaxy
- StellarParticle
- Malpedia, MISP Galaxy
Attributed facts
- Origin
Russia MISP Galaxy
Malware and tools
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Midnight Blizzard.
- Russian Hackers Used Claude to Evade Detection in Spy CampaignSecurityWeek
- APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updatesInfosecurity
- Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunchMicrosoft
- Amazon disrupts Russian APT29 hackers targeting Microsoft 365BleepingComputer · first in our coverage