Threat Actor ProfileCozy Bear

Cozy Bear’s activities have been traced back to 2008, although some argue their origins might go back as far as 2004. In a 2008 campaign, malware surfaced that made reference to Chechnya, a region in Russia where separatist resistance had sparked conflict with Russian forces. It was immediately clear that it concerned an ambitious threat actor, as they used two sets of custom malwares. This is quite rare for a new group and indicates significant investments in their capabilities. This was one of the first indicators that the group was aligned with the interests of Russia's Foreign Intelligence Service (SVR) .

In 2009, Cozy Bear expanded their focus to the West for the first time, exhibiting a keen interest in NATO and U.S. political-military affairs, another indication of SVR alignment. However it wasn't until 2013 that Kaspersky, a renowned cybersecurity firm, released the first public report on this threat actor. Subsequently, Cozy Bear swiftly gained infamy, despite their campaigns being cloaked in secrecy. Their notoriety stems from their selection of high-profile targets, and their ability to maintain their presence within infected systems undetected for several months.

Unlike many other Russian threat actors, Cozy Bear distinguishes itself through its stealthy operations, which align with their primary motivation of espionage and information theft. They target political entities, think tanks, and commercial companies dealing with highly sensitive information. On occasion, they even aim for seemingly unrelated organizations to gain access to their clients, employing a tactic known as a supply-chain attack.

Further evidence of their ties with the SVR is found in another one of their earlier campaigns. In 2009, Cozy Bear sought to gather intelligence on the upcoming U.S. missile defence system to be stationed in Europe. During the same period, Cozy Bear conducted operations to gain insights into NATO's relationship with Georgia. As Russia had previously invaded Georgia, any information detailing how the invasion impacted this relationship could prove valuable in future scenarios, such as the invasion of the Crimea peninsula.

However, the conclusive evidence of ties with the SVR came from the Dutch General Intelligence & Security Service (AIVD). In an unprecedented move in 2014, the AIVD gained access to the systems of Cozy Bear, going as far as taking control of their security cameras. The Dutch intelligence officers watched the hackers enter SVR-owned buildings and were able to identity some of them. This allowed the AIVD and the intelligence services of allied nations to learn about the day-to-day business of this advanced actor and how they operated. The extent of the infiltration was highlighted when it became known that the AIVD provided their American counterparts with near real-time intelligence on ongoing attacks, which was used to ward off the attempted hack. This remarkable ‘counter-hack’ lasted for a period of 1 to 2.5 years.