Midnight Blizzard

Reported Context (21)

Named as the group behind an intrusion at Microsoft detected in January 2024. The article identifies APT29 as an alternate name. Why Secure Configuration Can Outlast the Zero-Day Race
Public reporting linked GTG-20006 to this actor; Anthropic said its attribution was consistent with that reporting. Anthropic Reports Increasingly Autonomous AI Misuse in Cybercrime and Espionage
The article describes the campaign as linked to Midnight Blizzard but says RL's file analysis neither confirms nor contradicts the attribution. ReversingLabs Maps a Midnight Blizzard-Linked Campaign from Two Malware Hashes
The interviewer associates the actor with Captive Trench; Marcus discusses reported malicious captive portals and DNS access in that context. Security Researcher Discusses AI Guardrails, EDR Killers and VPN Limitations
Anthropic describes GTG-20006's attribution as consistent with public reporting linking the operator to Midnight Blizzard. ReversingLabs Found AI-Modified Malware Before Anthropic Report, Says Behaviors Still Reveal It

CVE (5)

Malware (21)

People (15)

Threat Actors (35)

MITRE ATT&CK (51)

Vendors (30)

Products (53)

Tools (20)

Industries (34)

Countries (21)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.