What other aliases and vendor names is UNC3524 known by?

UNC3524 is tracked across the cybersecurity industry by multiple aliases, including: APT29, ATK7, Blue Kitsune, BlueBravo, Cloaked Ursa, COZY BEAR, CozyDuke, Dark Halo.

What are the primary motivations and sponsors of UNC3524?

UNC3524 operates from Unknown with primary motivation categorized as Espionage, sponsored or affiliated with State-sponsored / Independent.

UNC3524

▲ High Threat

Primary Aliases: APT29 COZY BEAR Midnight Blizzard Nobelium

Sponsor / State Affiliation Independent / Not Attributed

Primary Motivation Espionage

Active Timeline Unknown – Present

Confidence Rating 70% (Grounded)

Mandiant observed this group operating since December 2019. Its techniques partially overlap with multiple Russian-based espionage actors (APT28 and APT29). They are described as having a high level of operational security, low malware footprint, adept evasive skills, and a large Internet of Things (IoT) device botnet at their disposal.