Threat actor

Cozy Bear

1 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 11, 2026 · last 6d ago

Timeline2 articles

Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research

Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.

Anthropic's latest threat intelligence report covers misuse of Claude Haiku, Sonnet, and Opus models across seven harm areas between December 2025 and August 2026. Russia's SVR espionage unit GTG-20006 (APT29/Midnight Blizzard/Cozy Bear) used AI to automate its full attack kill chain against more than 20 organizations across Ukraine, Europe, the Middle East, Asia, and North Africa. A ShinyHunters-linked supply-chain affiliate breached a SaaS provider and dumped over 2,100 Azure AD token sets spanning 40+ corporate tenants in about 34 hours, with AI agents performing nearly all the work. The report also documents five biological misuse cases (chikungunya, H5 avian influenza) and six conventional weapons development cases in China, Russia, and Yemen.

The Register · Securityupdated Sep 16, 17:41 UTC · 16h agofirst Sep 10, 22:38 UTC · 6d agoAI safety & security in the wild 20 sources

CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.

Zscaler ThreatLabz analyzed the CaptiveCrunch credential theft campaign first reported by Microsoft on July 31. Microsoft attributes the activity to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard (APT29, Cozy Bear, NOBELIUM, BlueBravo). The actor manipulates DNS and HTTP traffic on captive portal networks at hotels and conference centers, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery. Evidence indicates shared captive portal services were compromised rather than each venue being breached individually.

Zscaler ThreatLabzAug 11, 22:06 UTC · Aug 11, 2026Threat actor in the wild

Appears with

threat actor Midnight Blizzard 2 threat actor APT29 2 threat actor GTG-20006 1 threat actor NOBELIUM 1 threat actor ShinyHunters 1 threat actor Storm-2945 1 threat actor SVR 1 ai model Claude Haiku 1 ai model Claude Opus 1 ai model Claude Sonnet 1 organization Anthropic 1 organization ShinyHunters 1 organization SVR 1 organization Zscaler ThreatLabz 1 product Claude 1 product Claude Haiku 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.