page_title: Cozy Bear
section_title: Methods and technical capability
hierarchical_section_title: Cozy Bear / Methods and technical capability
caption_attribution_description: English: Diagram from US-CERT's report on APT28 and APT29 (aka GRIZZLY STEPPE) Description by source: "The tactics and techniques used by APT29 and APT 28 to conduct cyber intrusions against target systems"
context_page_description: Cozy Bear, classified as advanced persistent threat APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. The Dutch General Intelligence and Security Service deduced from security camera footage that it is led by the Russian Foreign Intelligence Service. Cybersecurity firm CrowdStrike also previously suggested that it may be associated with either the Russian Federal Security Service or SVR. The group was given other nicknames by other cybersecurity firms, including Office Monkeys, CozyCar, The Dukes, and CozyDuke.
context_section_description: Kaspersky Lab determined that the earliest samples of the MiniDuke malware attributed to the group date from 2008. The original code was written in assembly language. Symantec believes that Cozy Bear had been compromising diplomatic organizations and governments since at least 2010.
  The CozyDuke malware utilises a backdoor and a dropper. The malware exfiltrates data to a command and control server. Attackers may tailor the malware to the environment. The backdoor components of Cozy Bear's malware are updated over time with modifications to cryptography, trojan functionality, and anti-detection. The speed at which Cozy Bear develops and deploys its components is reminiscent of the toolset of Fancy Bear, which also uses the tools CHOPSTICK and CORESHELL.
  Cozy Bear's CozyDuke malware toolset is structurally and functionally similar to second stage components used in early Miniduke, Cosmicduke, and OnionDuke operations. A second stage module of the CozyDuke malware, Show.dll, appears to have been built onto the same platform as OnionDuke, suggesting that the authors are working together or are the same people. The campaigns and the malware toolsets they use are referred to as the Dukes, including Cosmicduke, Cozyduke, and Miniduke. CozyDuke is connected to the MiniDuke and CosmicDuke campaigns, as well as to the OnionDuke cyberespionage campaign. Each threat group tracks their targets and use toolsets that were likely created and updated by Russian speakers. Following exposure of the MiniDuke in 2013, updates to the malware were written in C/C++ and it was packed with a new obfuscator.
  Cozy Bear is suspected of being behind the 'HAMMERTOSS' remote access tool which uses commonly visited websites like Twitter and GitHub to relay command data.
  Seaduke is a highly configurable, low-profile Trojan only used for a small set of high-value targets. Typically, Seaduke is installed on systems already infected with the much more widely distributed CozyDuke.
caption: Diagram outlining Cozy Bear and Fancy Bear's  process of using of malware to penetrate targets
exif: {}