BlogTrace : Curated intelligence from security blog posts.

Microsoft breach by Midnight Blizzard (APT29): What happened, and what now?

Blog Source: MITIGA

IOC Available: no

YARA Rules: no

Timestamp: 2024.03.07
TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793

Blog Source: Fortinet

IOC Available: yes

YARA Rules: no

Timestamp: 2023.12.13
Backchannel Diplomacy: APT29’s Rapidly Evolving Diplomatic Phishing Operations

Blog Source: Mandiant

IOC Available: yes

YARA Rules: yes

Timestamp: 2023.10.18
Midnight Blizzard conducts targeted social engineering over Microsoft Teams

Blog Source: Microsoft

IOC Available: yes

YARA Rules: no

Timestamp: 2023.08.02
New invitation from APT29 to use CCleaner

Blog Source: lab52

IOC Available: yes

YARA Rules: no

Timestamp: 2023.07.12
Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Blog Source: lab52

IOC Available: yes

YARA Rules: no

Timestamp: 2023.07.07
New tricks of APT29 – update on the CERT.PL report

Blog Source: lab52

IOC Available: yes

YARA Rules: no

Timestamp: 2023.05.25
NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

Blog Source: Blackberry

IOC Available: yes

YARA Rules: no

Timestamp: 2023.03.14
Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

Blog Source: Medium

IOC Available: yes

YARA Rules: no

Timestamp: 2023.03.09
Malware analysis report: SNOWYAMBER APT29 related malwares

Blog Source: github

IOC Available: no

YARA Rules: no

Timestamp: 2023.01.01