{"id":56369,"date":"2024-06-20T12:27:13","date_gmt":"2024-06-20T12:27:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/russias-cyber-spies-still-threatening-french-national-security-democracy\/"},"modified":"2024-06-20T12:27:13","modified_gmt":"2024-06-20T12:27:13","slug":"russias-cyber-spies-still-threatening-french-national-security-democracy","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russias-cyber-spies-still-threatening-french-national-security-democracy\/","title":{"rendered":"Russia’s cyber spies still threatening French national security, democracy"},"content":{"rendered":"

A fresh report into the Nobelium offensive cyber crew published by France’s computer emergency response team (CERT-FR) highlights the group’s latest tricks as the country prepares for a major election and to host this year’s Olympic and Paralympic Games.<\/p>\n

Most infoseccers will know Nobelium\/Midnight Blizzard as the Russian intelligence (SVR)-linked criminals responsible for the major supply chain attack on SolarWinds in 2021, but CERT-FR believes sharing information about the latest exploits may stifle the gang’s threat to national security in the coming months.<\/p>\n

Nobelium’s activity is often also tied to the APT29 moniker, but the French cybersecurity agency (ANSSI) believes Nobelium is in fact a distinct intrusion set. It says the true APT29 was active between 2008-2019 and was responsible for the attack on the US DMC<\/a>, while Dark Halo was the group that carried out the SolarWinds breach<\/a>. To ANSSI, Nobelium is a separate entity but like the other two, is linked to the Russian intelligence service. ANSSI says it was spun up in October 2020.<\/p>\n

It’s targeting diplomats, ministry officials<\/h3>\n

The researchers say its main focus is espionage, and claim it often targets the email accounts of diplomatic staff, their institutions, embassies, and consulates using phishing emails sent from foreign institutions that have already been previously compromised by Nobelium.<\/p>\n

CERT-FR’s report states that the French public sector has been attacked several times by the group using this business email compromise<\/a> (BEC) style of attack.<\/p>\n