Cozy Bear

Cozy Bear, also tracked as APT 29, is a cyber espionage unit that conducts long‑term intelligence gathering operations on behalf of a state sponsor. Its core activity involves developing and deploying custom malware such as MiniDuke, CozyDuke and the SUNBURST backdoor, which was introduced through a supply‑chain compromise of SolarWinds software to gain persistent access to victim networks. The group focuses on infiltrating government, military, diplomatic and private‑sector entities worldwide, seeking to exfiltrate sensitive political, diplomatic, technological and health‑related data. Operations typically begin with credential harvesting, followed by lateral movement and the manipulation of authentication mechanisms like SAML tokens to maintain stealthy presence. Cozy Bear also leverages public platforms such as GitHub for command‑and‑control communication, blending malicious traffic with legitimate code‑hosting activity to evade detection.

What distinguishes Cozy Bear from many financially motivated cybercrime groups is its direct linkage to the Russian Foreign Intelligence Service (SVR), positioning it as a state‑sponsored actor with strategic objectives rather than profit motives. The unit is noted for its use of sophisticated, multi‑stage malware families that have been observed in high‑profile intrusions, including the compromise of the Democratic National Committee, Republican National Committee, various U.S. federal agencies, COVID‑19 research organisations, Microsoft and TeamViewer. Dutch intelligence services have publicly confirmed infiltrating the group’s infrastructure, providing insight into its targeting of U.S. institutions and its role in election‑interference efforts. These attributes underscore a focus on persistence, technical innovation and geopolitical intelligence collection rather than immediate financial gain.

Structurally, Cozy Bear operates as an element of the Russian state’s intelligence apparatus, with no publicly disclosed corporate hierarchy, subsidiaries or independent ownership; its activities are directed and resourced by the SVR. The group’s alignment with a national intelligence service explains its access to state‑level resources, its ability to conduct supply‑chain attacks on widely used software platforms, and its sustained presence across multiple geographic regions over several years. This organisational framing situates Cozy Bear within the broader landscape of nation‑state cyber threats, where its actions serve strategic national interests rather than commercial objectives.