Skip to content
Start with Identity
Join free
Threat actor · Nation-state · MITRE ATT&CK G0016

Midnight Blizzard (APT29) identity breaches

APT29 is a threat group that MITRE ATT&CK tracks as G0016 and says has been attributed to Russia's Foreign Intelligence Service (SVR). Microsoft tracks it as Midnight Blizzard, formerly NOBELIUM, and other names include Cozy Bear and UNC2452. Microsoft says the US and UK governments attribute the group to the SVR and that it mainly targets governments, diplomatic entities, NGOs and IT service providers in the US and Europe. Its identity tradecraft in this database is low-volume password spraying, abuse of OAuth applications and service principals, and abuse of the delegated administrative privileges that service providers hold over customer tenants. In January 2024 Microsoft disclosed that the group sprayed a legacy non-production test tenant account that had no MFA, then used a legacy test OAuth application with elevated privileges to grant itself access to corporate mailboxes.

Also tracked as
APT29, NOBELIUM, Cozy Bear, UNC2452, The Dukes
Origin (as attributed)
Russia: attributed to the Foreign Intelligence Service (SVR) by the US and UK governments, per MITRE ATT&CK and Microsoft
MITRE ATT&CK
G0016
Profile verified
Nov 5, 2026
6
incidents in the database, disclosed 2021-2024
0 / 1
MFA bypassed / not enforced (5 not applicable or undisclosed)
33%
began with password spraying
4 / 2
human / non-human identity abused

Incidents attributed to Midnight Blizzard (APT29)

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity techniques used

Identity controls that failed

How to defend against Midnight Blizzard (APT29)

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Password spraying (2 of 6): Enforce MFA on every account, including test, legacy and non-production tenants, block legacy authentication, and ban common passwords. See Password spraying, Orphaned account abuse and Conditional access.
  2. Stolen credentials (1 of 6): Assume passwords leak: enforce phishing-resistant MFA on every account, watch for infostealer exposure of employee credentials, and revoke sessions when a credential is reported stolen. See Infostealer credential harvesting and Infostealer.
  3. Third-party access (1 of 6): Give vendors and outsourced support only the access they need, for as long as they need it, and review delegated administrative rights regularly. See Least privilege, Just-in-time access and PAM.
  4. OAuth token abuse (1 of 6): Inventory third-party OAuth integrations, scope their tokens narrowly, restrict where they can be used from, and revoke refresh tokens when a vendor is breached. See Refresh token abuse, Refresh token and Non-human identity.
  5. Supply chain (1 of 6): Treat vendor-issued credentials, certificates and service principals as high-value non-human identities: inventory them, scope them and rotate them after any vendor compromise. See Non-human identity and Secrets rotation.

Sources

  1. APT29, Group G0016
  2. Midnight Blizzard: guidance for responders on nation-state attack (Microsoft Threat Intelligence, 2024-01-25)
  3. NOBELIUM targeting delegated administrative privileges to facilitate broader attacks (Microsoft, 2021-10-25)
  4. ED 24-02: Mitigating significant risk from nation-state compromise of Microsoft corporate email system (CISA)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has Midnight Blizzard (APT29) been linked to?
The Identity Breach Database attributes 6 identity breaches disclosed 2021-2024 to Midnight Blizzard (APT29): TeamViewer corporate IT intrusion via a compromised employee account (2024), Midnight Blizzard password spray into Microsoft corporate email (2024), Nobelium abuse of reseller delegated administrative privileges (2021), Nobelium password spray campaign and Microsoft support agent compromise (2021), Malwarebytes email access via abused Microsoft 365 application (2021) and Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor (2021). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does Midnight Blizzard (APT29) get initial access?
Across its 6 records, the initial access vectors were password spraying (2), stolen credentials (1), third-party access (1), oauth token abuse (1) and supply chain (1). The identity control that failed most often was authentication (2 of 6).
Did MFA stop Midnight Blizzard (APT29)?
In 0 of 6 incidents MFA was present and bypassed, and in 1 it was not enforced on the abused account. In the remaining 5, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. 2 of the incidents abused a non-human identity, where user MFA does not apply.

Cite this page

SWI Community Team. (2026). Midnight Blizzard (APT29) identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/midnight-blizzard/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.