CERTFR-2024-CTI-006.pdf
Excerpt
MALICIOUS ACTIVITIES LINKED TO THE NOBELIUM INTRUSION SET
2024-06-19
The Nobelium intrusion set
ANSSI considers that the Nobelium intrusion set, also calledMidnight Blizzard 1, has been active since at least Octo-ber 2020. It is actively used against high-value targets, most likely for espionage purposes. Phishing campaigns conducted by Nobelium operators have targeted countries in Europe, Africa, North America and Asia. Activities linked to this intrusion set have been publicly linked to the Russian foreign intelligence service SVR.
Several observers and ANSSI’s partners describe activities tied to this intrusion set under the name APT29. How-ever, based on the observation of attackers’ evolving codes, tactics, technics and procedures, ANSSI prefers to dif-ferentiate three different…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ANSSI (CERT-FR) on cert.ssi.gouv.fr.
Mentioned in the excerpt
More from ANSSI (CERT-FR)12
- 🇬🇧 Houken seeking a path by living on the edge with zero-daysANSSI (CERT-FR) · Added 18 Oct
- CERTFR-2019-CTI-006.pdfANSSI (CERT-FR) · Added 26 Feb
- CERTFR-2019-CTI-006-EN.pdfANSSI (CERT-FR) · Added 26 Feb
- CERTFR-2022-CTI-006.pdfANSSI (CERT-FR) · Added 26 Feb
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
