Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Known aliases
APT29Cozy BearMidnight BlizzardNOBELIUM
Palo Alto Networks Unit 42 · 20 Aug 2026
Threat Research CenterThreat ResearchMalware Malware Identity Abuse Through Trusted Communication Channels 12 min read Related ProductsCortexCortex XDRCortex XSIAMIdiraUnit 42 Incident Response By:Bill Batchelor Published:August 20, 2026 Categories:MalwareThreat Research Tags:AuthenticationIdentity theftMalwareMFARemote access softwareSocial engineering Share Executive Summary Identity has…
Google Threat Intelligence Group · 20 Aug 2026
Threat IntelligenceGoing with the Flow(s): Distinct Clusters Target Individuals of Interest to RussiaAugust 20, 2026Google Threat Intelligence Group Google Threat IntelligenceVisibility and context on the threats that matter most.Contact Us & Get a Demo Written by: Gabby Roncone,…
Google Threat Intelligence Group · 30 Jul 2026
Written by: Kelli Vanderlee, Stuart Carrera For years, the cybersecurity industry's understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise…
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
Microsoft Security Blog · 31 Jul 2026
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an…
