Skip to content
Threat Feed
Subscribe

Actor

Cozy Bear

5 briefs RSS
Also known as: APT29 NOBELIUM UNC2452 Midnight Blizzard The Dukes
medium threat

Abuse of CertUtil for File Deobfuscation

Adversaries frequently abuse the legitimate Windows CertUtil utility to decode obfuscated malicious payloads, facilitating defense evasion and subsequent unauthorized code execution.

Windows APT29 +5 defense-evasion living-off-the-land
1r 1t
medium threat

Detection of Unsigned DLL Side-Loading Mimicking Microsoft

Adversaries utilize unsigned DLLs masquerading as Microsoft-signed libraries within non-standard directories to achieve code execution, persistence, and privilege escalation via DLL side-loading.

APT29 +5
1r 1t
high threat

SUNBURST Command and Control Activity Detected

This rule detects post-exploitation command and control activity related to the SUNBURST backdoor, which targets SolarWind's Orion software, mimicking the Orion Improvement Program (OIP) protocol for covert communication.

SolarWinds Orion Platform APT29 +5 solarwinds sunburst supply-chain command-and-control
2r 2t
high threat

Potential Vcruntime140 DLL Sideloading

Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library, often used by threat actors like APT29 (via WinELOADER) to load malicious payloads under the guise of legitimate applications, leading to defense evasion, persistence, and privilege escalation.

Visual C++ Redistributable APT29 +5 dll-sideloading vcruntime140.dll wineloader defense-evasion persistence privilege-escalation
2r 3t
high threat

Okta Multiple Failed MFA Requests Indicate Potential MFA Bypass Attempt

An adversary may attempt to bypass MFA by bombarding a user with repeated authentication requests, potentially leading to unauthorized access and system compromise.

Okta Lapsus$ +6 mfa credential-access mfa-bypass
2r 1t