TLP:CLEAR

MALICIOUS ACTIVITIES LINKED TO THE NOBELIUM INTRUSION SET
2024-06-19

The Nobelium intrusion set
ANSSI considers that the Nobelium intrusion set, also called Midnight Blizzard 1 , has been active since at least October 2020. It is actively used against high-value targets, most likely for espionage purposes. Phishing campaigns
conducted by Nobelium operators have targeted countries in Europe, Africa, North America and Asia. Activities
linked to this intrusion set have been publicly linked to the Russian foreign intelligence service SVR.
Several observers and ANSSI’s partners describe activities tied to this intrusion set under the name APT29. However, based on the observation of attackers’ evolving codes, tactics, technics and procedures, ANSSI prefers to differentiate three different and full-fledged SVR-related intrusion sets: APT29, also known as The Dukes, reportedly
active since at least 2008, used until 2019 against various governments, think-tanks, diplomatic entities and politicalparties and notably associated with the 2015 attack against the American Democratic National Committee 2 ; Dark
Halo, publicly linked to the supply chain attack via SolarWinds and exposed in December 2020; and Nobelium, likely
active since at least October 2020.
Nobelium is characterized by the use of specific codes, tactics, technics and procedures. Most of Nobelium campaigns against diplomatic entities use compromised legitimate email accounts belonging to diplomatic staff,
and conduct phishing campaigns against diplomatic institutions, embassies and consulates. These activities
are also publicly described as a campaign called “Diplomatic Orbiter”. The lure documents used in these attacks are
typically forged to target diplomatic staff. The operators attempt to deliver their own private loaders, in order to
execute public tools such as Cobalt Strike or Brute Ratel C4, to access the victim’s network, ensure persistence andexfiltrate valuable intelligence. However, several IT companies have also reported that they have been targeted byNobelium’s operators in late 2023 and 2024.
December: supply-chain attack
via Solar Winds

February-May: targeting of theFrench MFA

May: targeting of French embassiesin Ukraine and Romania

APT29
Dark Halo
2015: attack against the American
Democratic National Committee

Nobelium
March-May: targeting ofseveral French embassies

December: attackagainst Microsoft

January: attack
against Hewlett
Packard Enterprise

Examples of attacks linked with APT29, Dark Halo and Nobelium

Malicious activities against French diplomatic entities
Western diplomatic entities, such as embassies and Ministries of Foreign Affairs, account for the majority of known
Nobelium’s victims. French public organisations have been targeted several times by phishing emails sentfrom foreign institutions previously compromised by Nobelium’s operators.
From February to May 2021, Nobelium operators conducted several phishing campaigns 3 exploiting compromised
email accounts belonging to the French Ministry of Culture and the National Agency for Territorial Cohesion(ANCT), sending an attachment called “Strategic Review”. The investigations led by ANSSI concluded that the1. https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-threat-actor-naming?view=o365worldwide
2. https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
3. https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-011/

Page 1 of 3

TLP:CLEAR

Malicious activities linked to the Nobelium intrusion setattackers did not manage to move laterally within the Ministry of Culture and the ANCT information systems.
These compromised accounts have been used to target a variety of entities, including the French Ministry of Foreign Affairs. Nobelium operators attempted to install the Cobalt Strike tool on the French Ministry of Foreign
Affairs information system, which could have enabled remote control on the compromised machines. However,
the attack against the French Ministry of Foreign Affairs was unsuccessful.
In March 2022, a European embassy in South Africa received a malicious email impersonating a French embassy,
which announced its closing due to an unspecified terrorist act. The phishing emails were sent from a compromised
account belonging to a French diplomat.
In April and May 2022, dozens of email addresses belonging to the French Ministry of Foreign Affairs were targetedby phishing emails linked to Nobelium. In order to draw the attention of their targets, these phishing emails werethemed on the closing of a Ukrainian embassy or an appointment with a Portuguese ambassador.
In May 2023, several European embassies in Kyiv were targeted by a phishing campaign conducted by Nobelium’soperators. The French embassy in Kyiv was one of the targets of this campaign, which was conducted through anemail that was themed about a “Diplomatic car for sale”.
In May 2023, an attempt by Nobelium operators to compromise the French Embassy in Romania was detected butwas also unsuccessful thanks to the appropriate behavior of the diplomatic staff.
ANSSI and C4 members consider that the imputation of these activities against French diplomatic entities
to Nobelium is consistent. The tools and infrastructures employed by the attackers show similarities with otherNobelium-linked campaigns. The victims of these activities aiming to exfiltrate strategic intelligence are consistent
with the usual targeting associated with Nobelium by other observers. The capabilities implemented to compromise such a vast number of email accounts, the persistence of the attacks, the efforts put into the forgery of lure
documents indicate that Nobelium is almost certainly operated on behalf of a state actor.

Malicious activities against international IT entities
Several companies in the IT industry have disclosed their targeting and compromise by Nobelium’s operators. According to Microsoft, part of the activities linked to Nobelium (alias Midnight Blizzard) has targeted technology
companies worldwide, especially in North America and Western Europe.
Microsoft reported a security incident at the end of November 2023 attributed to Nobelium 4 . The attackers exfiltrated emails from the cybersecurity and legal teams as well as executives. The cybersecurity teams at Microsoft
regularly publish intelligence concerning Nobelium’s activities: the attackers may have tried to find out the information Microsoft held on their operations. These insights could give the attackers opportunities to improve theiroperational security, to avoid the detection of their attacks and to hinder the analysts’ monitoring capabilities.
In January 2024, the American company Hewlett Packard Enterprise (HPE) has reported that a suspected nationstate actor, believed to be the threat actor Midnight Blizzard obtained a non-authorized access to the company’s
cloud-based email environment 5 .
A report 6 published in December 2023 by Polish, British and American authorities stated that Nobelium operators
had exploited CVE-2023-42793 since September 2023 on a large scale against servers hosting the JetBrains softwaredeveloped by TeamCity. It seems that this campaign was opportunistic and not driven by a consistent targeting
pattern: at least a dozen companies in various countries and sectors have been identified as compromised. According to CERT.PL, the compromise of TeamCity servers could have made it possible to carry out supply-chain attacks,
however such attempts have not been observed. Nevertheless, this campaign shows that Nobelium’s operators arepotentially looking for opportunities to carry out supply-chain attacks.

4. https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnightblizzard/
5. https://www.sec.gov/Archives/edgar/data/1645590/000164559024000009/hpe-20240119.htm
6. https://cert.pl/en/posts/2023/12/apt29-teamcity/

Page 2 of 3

TLP:CLEAR

Malicious activities linked to the Nobelium intrusion set

Nobelium remains an active threat to French and international interests
ANSSI has observed a high level of activities linked to Nobelium against the recent backdrop of geopolitical tensions,especially in Europe, in relation to Russia’s aggression against Ukraine. Nobelium’s activities against governmentand diplomatic entities represent a national security concern and endanger French and European diplomaticinterests.
The targeting of IT and cybersecurity entities for espionage purposes by Nobelium operators potentially strengthen
their offensive capabilities and the threat they represent. The intelligence gathered during recent attacks against
IT sector entities could also facilitate Nobelium’s future operations.
Nobelium’s technics, tactics and procedures remain mainly constant over time. Technical elements are available in
ANSSI’s publication dated of the 6th of December 2021 “Phishing campaigns by the Nobelium intrusion set” 7 .
Moreover, ANSSI and its partners observed several indicators of compromise (IOCs) linked to Nobelium’s latest
campaigns. They are available on Zscaler 8 and Mandiant 9 websites.

7. https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-011/
8. https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader
9. https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties

Page 3 of 3