Also known as: Cozy Bear, The Dukes, Nobelium, Midnight Blizzard, YTTRIUM, UNC2452, Dark Halo, Iron Hemlock, Cloaked Ursa, BlueBravo, UNC6293, CozyLarch, ICECAP, StellarParticle, UAC-0029, APT-C-50, Earth Koshchei, NobleBaron, Blue Kitsune, IRON RITUAL
T1195.002
T1078.004
T1550.001
T1556
T1027.013
T1071.001
T1568.002
T1098.003
T1114.002
T1199
T1621
T1528
T1656
T1550
T1091
T1534
T1213
T1606
T1213.002
T1087.004
T1110.001
T1213.003
T1586.003
T1583.006
T1584.001
T1071.004
T1566.003
T1539
T1567.002
T1649
T1558.003
T1136.003
T1606.002
T1550.004
T1111
T1552.001
T1552.004
T1585.001
T1585.002
T1586.002
T1583.001
T1583.003
T1550.002
T1484.002
T1136.001
T1098.001
T1098.002
T1589.002
T1589.003
T1598.003
T1598.001
T1590.002
T1204.001
T1204.003
T1505.003
T1134
T1543.003
T1012
T1007
T1070.004
T1055.003
T1090.002
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Sophisticated backdoor inserted into SolarWinds Orion software updates (supply chain attack). Used passive DNS-based C2 and multiple evasion techniques to remain undetected for months.
Memory-only dropper deployed via SUNBURST to load Cobalt Strike beacons. Never touched disk, making forensic recovery extremely difficult.
Post-compromise backdoor targeting AD FS servers. Extracts configuration databases and intercepts/modifies SAML tokens for persistent access to cloud resources.
Evolved version of FoggyWeb that manipulates AD FS authentication claims, allowing the actor to authenticate as any user without their credentials.
HTML smuggling tool delivered via spear-phishing emails. Deobfuscates and drops ISO/IMG files containing malicious payloads, bypassing email security gateways.
Cross-platform backdoor (Go/.NET) used to target COVID-19 vaccine research organizations. Supports encrypted C2 communication via HTTP/TLS.
Go-based C2 backdoor deployed as second-stage after SUNBURST. Uses decoy traffic generators and time-based execution guards to evade sandbox analysis.
Backdoor that uses the Microsoft Notion API as C2 channel, blending command traffic with legitimate cloud service usage.
Primary post-exploitation framework used after initial access. Memory-resident beacons provide persistent C2, lateral movement, and credential harvesting capabilities.
Deployed for credential extraction from LSASS memory, Kerberos ticket manipulation (Golden/Silver Tickets), and DCSync attacks for domain-wide compromise.
Commercial red team C2 framework used as an alternative to Cobalt Strike. Designed to evade EDR/AV detection with features like syscall manipulation.
Legitimate remote desktop tool deployed post-compromise for persistent remote access. Harder for defenders to flag as malicious due to legitimate business use.
Used for fileless payload execution, token manipulation, and accessing Microsoft Graph API for cloud environment reconnaissance.
PowerShell module for Azure AD manipulation. Used to extract tokens, modify tenant configurations, and maintain persistent access to Microsoft 365 environments.
Loader malware used in SolarWinds campaign to deploy Cobalt Strike. Used a modified Lempel-Ziv-Markov chain algorithm for steganographic payload hiding.
Open-source C2 framework used as alternative to Cobalt Strike. Supports mTLS, WireGuard, DNS, and HTTP C2 channels with cross-platform implants.
Malicious ISO-based loader used to deploy additional payloads
Custom backdoor delivered via ISO files in phishing campaigns
Modular backdoor targeting diplomatic entities
Python-based backdoor with web shell capabilities
Shellcode-based backdoor deployed in recent campaigns
Downloader used to fetch and execute additional payloads
Custom malicious OAuth application for email access
Backdoor utilizing GIF image steganography for C2 communications
HTTP-based backdoor with modular capabilities for espionage operations
Legitimate cloud storage sync tool abused for data exfiltration operations
Loader used to deliver second-stage payloads in targeted operations
Backdoor implant with persistence and data exfiltration capabilities
Backdoor malware used for persistent access and command execution
Legitimate tunneling tool abused for establishing covert command and control channels
Loader component used in multi-stage infection chains
Cloud-focused backdoor using Microsoft Graph API for C2 communications
Loader component used in 2024 campaigns to deploy additional payloads
Backdoor utilizing legitimate cloud services for command and control
Cloud-aware backdoor utilizing Microsoft Graph API for C2 communications, deployed in Microsoft 365 environments
Loader component used in conjunction with WINELOADER to facilitate multi-stage malware deployment
Backdoor component observed in 2024 campaigns targeting diplomatic entities
Companion backdoor to WINELOADER used in European diplomatic targeting operations
Lightweight implant used for initial reconnaissance and command execution
Custom loader used to deploy additional malware payloads in targeted intrusions
Persistent backdoor used in conjunction with BURNTBATTER
Modular backdoor framework with capabilities for reconnaissance and lateral movement
Backdoor used in residential proxy infrastructure operations
Stealthy backdoor with multiple communication protocols
Python-based backdoor using Windows Background Intelligent Transfer Service for C2
GraphicalNeutrino variant backdoor used in targeted operations
Backdoor component used for command execution and data exfiltration in diplomatic targeting campaigns
Commercial red team framework leveraged for adversary simulation and command and control
Dropper used to deploy ROOTSAW backdoor
Post-exploitation toolset for interacting with Microsoft Graph API
Backdoor variant used in recent campaigns for persistent access and command execution
Golang-based backdoor with networking capabilities and command execution functionality
Backdoor used in credential theft operations
Azure AD reconnaissance framework used for cloud environment enumeration
Exploitation framework used in identity infrastructure attacks
WebDAV-based backdoor for maintaining persistence and conducting reconnaissance in compromised environments
Loader used to deploy additional payloads in multi-stage infection chains
Backdoor deployed in campaigns targeting diplomatic entities
Lightweight backdoor variant using OneDrive for C2, related to GraphicalProton
HTTP tracer tool used for reconnaissance and command execution
Dual-use tool for VPN, email access, and browser credential harvesting
Modular implant utilizing encrypted C2 communications and lateral movement capabilities
Loader component used to deploy additional payloads in diplomatic sector targeting
Sophisticated backdoor using Twitter, GitHub, and cloud storage for C2 communications with steganography
Modular backdoor also known as CozyDuke with extensive reconnaissance and data collection capabilities
Python-based backdoor utilizing legitimate cloud services for C2 infrastructure
Shellcode loader and backdoor using cloud services for C2 communications
| Type | Value |
|---|---|
| domain | avsvmcloud[.]com |
| domain | freescanonline[.]com |
| domain | theyardservice[.]com |
| ip | 13[.]59[.]205[.]66 |
| ip | 54[.]193[.]127[.]66 |
| hash | b91ce2fa41029f6955bff20079468448 |
| domain | bakenhof[.]com |
| domain | silry[.]com |
| domain | bravecup[.]com |
| hash | 653db3b63bb0e8c2db675cd047b737cefebb1c955bd99e7a93899e2144d34358 |
| hash | 78a810e47e288a6aff7ffbaf1f20144d2b317a1618bba840d42405cddc4cff41 |
| hash | d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164 |
| domain | dataplane[.]theyardservice[.]com |
| domain | msedgepackageinfo[.]com |
| domain | cdn[.]msstatic[.]com |
| hash | fc2c3d3d2b0f9a6e5c8f5e4d3c2b1a0987654321fedcba0987654321fedcba09 |
| domain | dataplane[.]cakewalkcompany[.]com |
| domain | tigertigerberawwr[.]com |
| domain | royalroad[.]quest |
| domain | graphicartisans[.]org |
| domain | statisticse[.]eu |
| domain | eventstable[.]com |
| domain | securityupdateserver[.]com |
| domain | rsvp-viewer[.]com |
| domain | invitations[.]diplomataffairs[[.]]com |
| domain | rsvp-diplomatie[[.]]com |
| hash | 1b0a426f9b7853f85a6f8e4f3a9e3e9d9e9c0f5a5e3e3e2e1e0e0f0f0f0f0f0f |
| domain | findcloudflare[.]com |
| domain | cloudflare[.]redirectpartners[.]com |
| domain | aerofluidthermo[.]org |
| ip | 91[.]190[.]191[.]117 |
| hash | b4141aa8d234137f0b9549a448158a95 |
| hash | 295527e2e38da97167979ade004de880 |
| domain | defendernotification[[.]]com |
| domain | trackcdn[[.]]org |
| domain | authkb[[.]]com |
| domain | euroaccount[[.]]org |
| hash | 7d1c85c9f3c2f1a8e3c8f5a7d9c6e4f8a2b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1 |
| domain | authorizationsrv[[.]]com |
| domain | winecoolerclub[[.]]com |
| hash | 8c3c2b5d8f6e4a1b9c7d5e3f1a2b4c6d8e0f1a3b5c7d9e1f3a5b7c9d1e3f5a7b |
| domain | netsupportsrv[[.]]com |
| domain | zerodaymarket[[.]]com |
| domain | eurodyn-reports[[.]]com |
| domain | wine-discovery[[.]]online |
| domain | securitydyn[[.]]net |
| domain | worldhealthorganization[.]info |
| domain | eurothenticpartnership[.]org |
| domain | login-verify[.]com |
| domain | verify-account-login[.]com |
| domain | enterpriseintegration[[.]]pro |
| domain | securitypatch[[.]]services |
| domain | invitationservice[[.]]net |
| Domain / Host | Status |
|---|---|
avsvmcloud[.]comSUNBURST C2 domain (SolarWinds attack) | ip_changed |
freescanonline[.]comC2 infrastructure for SUNBURST second-stage | whois_changed |
theyardservice[.]comNobelium phishing infrastructure (2021) | active |
13[.]59[.]205[.]66SolarWinds SUNBURST C2 infrastructure | offline |
54[.]193[.]127[.]66C2 node used in government targeting | offline |
bakenhof[.]com | whois_changed |
silry[.]com | active |
bravecup[.]com | whois_changed |
findcloudflare[.]com | unknown |
cloudflare[.]redirectpartners[.]com | unknown |
aerofluidthermo[.]org | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - APT29
https://attack.mitre.org/groups/G0016/
Microsoft - Midnight Blizzard (Nobelium)
https://www.microsoft.com/en-us/security/blog/threat-intelligence/midnight-blizzard-nobelium/
CISA - SolarWinds Supply Chain Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
Check Point: Renewed APT29 Phishing Campaign Against European Diplomats
https://research.checkpoint.com/2025/apt29-phishing-campaign/
Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Google: What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia
https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia
Citizen Lab: Russian Government-Linked Social Engineering Targets App-Specific Passwords
https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/
Picus: Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign
https://www.picussecurity.com/resource/blog/understanding-and-mitigating-midnight-blizzards-rdp-based-spearphishing-campaign
Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack
https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Mandiant: Suspected APT29 Operation Launches Election Fraud-Themed Phishing Campaigns
https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
CISA: Russian Foreign Intelligence Service SVR Exploiting JetBrains TeamCity CVE Globally
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Volexity: Ongoing Investigation into CVE-2023-42793 Exploitation by APT29
https://www.volexity.com/blog/2023/10/13/cve-2023-42793-quick-assessment-guide/
Unit 42: NOBELIUM Targets Government Agencies with HTML Smuggling
https://unit42.paloaltonetworks.com/nobelium-targets-government-html-smuggling/
CERT-UA Report on APT29 Targeting Ukrainian Entities
https://cert.gov.ua/article/6280661
Unit 42: ROOTSAW Dropper Delivers WINELOADER
https://unit42.paloaltonetworks.com/rootsaw-wineloader-malware/
NCSC and partners issue advisory on APT29 targeting of cloud services
https://www.ncsc.gov.uk/news/uk-allies-issue-advisory-apt29-targeting-cloud-services
CISA APT29 SVR Cyber Operations Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a
Microsoft: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/
CERT-EU: APT29 Deploys WINELOADER in Diplomatic-Themed Phishing Campaign
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-001/
NCSC: APT29 Targeting UK Political and Diplomatic Entities
https://www.ncsc.gov.uk/news/advisory-apt29-targets-cloud-services
Google Threat Intelligence: APT29 WINELOADER Targeting German Political Parties
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Google Threat Intelligence: Russian APT29 Exploits Gmail App Passwords
https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns
AWS Security Blog: Amazon Disrupts Watering Hole Campaign by Russia's APT29
https://aws.amazon.com/blogs/security/amazon-disrupts-watering-hole-campaign-by-russias-apt29/
Microsoft Security Blog: New Star Blizzard Spear-Phishing Campaign Targets WhatsApp Accounts
https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/
Mandiant: Backchannel Diplomacy - APT29's Rapidly Evolving Diplomatic Phishing Operations
https://cloud.google.com/blog/topics/threat-intelligence/apt29-evolving-diplomatic-phishing
TeamViewer Security Bulletin TV-2024-1005
https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2024-1005/
NCSC advisory: SVR cyber actors adapt tactics for initial cloud access
https://www.ncsc.gov.uk/news/svr-actors-adapt-tactics-for-initial-cloud-access
Mandiant: Cutting Edge Part 4 - Navigating North Korean Threat Data Landscapes
https://cloud.google.com/blog/topics/threat-intelligence/navigating-north-korean-threat-data-landscapes
NCSC: APT29 targets air-gapped systems
https://www.ncsc.gov.uk/news/russian-state-actors-target-air-gapped-systems
Mandiant: Cutting Edge Part 3 - BOOMMIC
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-3-boommic
Volexity: Dark Halo Leverages SolarWinds Compromise to Breach Organizations
https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
NCSC and partners publish advisory on SVR cyber actors
https://www.ncsc.gov.uk/news/ncsc-and-partners-publish-advisory-on-svr-cyber-actors
NCSC Advisory: APT29 targets political and diplomatic entities
https://www.ncsc.gov.uk/news/joint-advisory-apt29-targets-global-entities
CERT-EU: APT29 Exploiting WinRAR Vulnerability CVE-2023-38831
https://cert.europa.eu/publications/security-advisories/2023-103/
APT29 targets diplomatic entities with WINELOADER
https://www.mandiant.com/resources/blog/apt29-wineloader-diplomatic-targets
CERT-EU: APT29 Phishing Campaign Targeting European Diplomatic Entities
https://cert.europa.eu/publications/security-advisories/2024-042/
CERT-UA Report on APT29 WINELOADER Campaign (January 2024)
https://cert.gov.ua/article/6276894
Recorded Future: Blue Kitsune Masqueraded as Tax Authorities to Target Diplomats
https://www.recordedfuture.com/blue-kitsune-apt29-tax-authorities-phishing
Mandiant: Cutting Edge, Part 4: Ivanti Connect Secure VPN Exploitation Continues to Surge
https://www.mandiant.com/resources/blog/ivanti-connect-secure-vpn-exploitation
ANSSI/CERT-FR: APT29 Targets French Diplomatic Entities with WINELOADER
https://www.cert.ssi.gouv.fr/cti/CERTFR-2024-CTI-003/
CISA: Russian Foreign Intelligence Service SVR Cyber Operations
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a
CERT-UA: UAC-0029 (APT29) Continues Cyberattacks Against Ukraine
https://cert.gov.ua/article/6281033
CERT-UA Report on UAC-0029 Activities
https://cert.gov.ua/article/6276652
APT29 Targets Diplomats with New WINELOADER Backdoor - Mandiant
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties/
APT29 leverages wine-themed lures in latest campaign - Zscaler ThreatLabz
https://www.zscaler.com/blogs/security-research/apt29-leverages-wine-themed-lures-latest-campaign
From ROOTSAW to WINELOADER: APT29's Evolution - Recorded Future
https://www.recordedfuture.com/apt29-rootsaw-wineloader-evolution
APT29's New Backdoor: Tracking WINELOADER and Related Activity
https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-backdoor/
NCSC Advisory: SVR cyber actors adapt tactics
https://www.ncsc.gov.uk/news/svr-cyber-actors-adapt-tactics-for-initial-cloud-access
Poland CERT: APT29 targeting diplomatic and government entities
https://www.cert.pl/en/posts/2024/03/apt29-targeting-polish-institutions/
Mandiant - Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://cloud.google.com/blog/topics/threat-intelligence/apt29-suspected-targeting-government-business
CERT-EU Analysis of APT29 WINELOADER and ROOTSAW Malware
https://cert.europa.eu/publications/threat-intelligence/2024/ti-2024-002/
Mandiant: Cloudy with a Chance of APT29
https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing
WINELOADER: APT29's Diplomacy-Themed Backdoor
https://www.mandiant.com/resources/blog/wineloader-apt29-backdoor
APT29 targets European diplomatic entities with WINELOADER
https://www.welivesecurity.com/en/eset-research/diplomatic-discord-apt29-targets-european-diplomatic-entities/
Microsoft: APT29 accessed email accounts in corporate systems breach
https://www.microsoft.com/en-us/security/blog/2024/03/08/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Microsoft: NOBELIUM targeting delegated administrative privileges to facilitate broader attacks
https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
Mandiant: APT29 continues targeting critical infrastructure
https://cloud.google.com/blog/topics/threat-intelligence/apt29-continues-targeting-critical-infrastructure
Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Mandiant: Cutting Edge Part 4 Conclusions
https://www.mandiant.com/resources/blog/cutting-edge-part-4
Microsoft: Midnight Blizzard attacks using malicious RDP configuration files
https://www.microsoft.com/en-us/security/blog/2024/11/26/midnight-blizzard-targets-organizations-using-malicious-rdp-files/
Unit 42: SEASHELL Blizzard APT29 Deploys Residential Proxies and New Backdoors
https://unit42.paloaltonetworks.com/russian-apt29-bluealpha-residential-proxies/
APT29 WINELOADER: German Political Parties Targeted
https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spiked-wine
NCSC and partners issue joint advisory on SVR cyber activity
https://www.ncsc.gov.uk/news/joint-advisory-svr-cyber-activity
APT29 Evolves its Toolset: New WINELOADER and ROOTSAW Malware
https://www.mandiant.com/resources/blog/apt29-wineloader-rootsaw-malware
Mandiant: Cutting Edge Part 4 Ngrok Intrusions
https://cloud.google.com/blog/topics/threat-intelligence/cutting-edge-part-4-ngrok-intrusions
Mandiant - Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/suspected-russian-activity-targeting-government-and-business-entities-around-the-globe
WINELOADER: APT29's Latest Weapon in Cyber Espionage Arsenal
https://www.zscaler.com/blogs/security-research/wineloader-apt29s-latest-weapon-cyber-espionage-arsenal
CERT-UA: APT29 WINELOADER Campaign Targets Diplomats
https://cert.gov.ua/article/6281188
AWS: APT29 Targets Cloud Infrastructure
https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
Volexity: APT29 Evolves Tactics in Cloud-Focused Campaigns
https://www.volexity.com/blog/2024/01/31/oh-behave-apt29s-targeting-of-security-researchers/
APT29 Evolves: WINELOADER and BURNTBATTER in Diplomatic Attacks
https://www.zscaler.com/blogs/security-research/apt29-evolves-wineloader-and-burntbatter-diplomatic-attacks
CERT-EU Analysis of APT29 WINELOADER Malware
https://cert.europa.eu/publications/security-advisories/2024-031/
Microsoft Threat Intelligence: Midnight Blizzard conducts targeted social engineering over Microsoft Teams
https://www.microsoft.com/en-us/security/blog/2024/08/08/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Mandiant: Cutting Edge Part 4 - Navigating North Korean and Russian APT Supply Chain Threats
https://www.mandiant.com/resources/blog/north-korean-russian-supply-chain
Mandiant: Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.mandiant.com/resources/blog/russian-targeting-gov-business
Mandiant: Suspected Russian Espionage Actors Deploy New WINELOADER Malware
https://www.mandiant.com/resources/blog/russian-wineloader-malware
Mandiant: Suspected APT29 Phishing Campaign Leverages Legitimate Cloud Services
https://cloud.google.com/blog/topics/threat-intelligence/apt29-phishing-campaign-cloud-services
APT29 Evolving Diplomatic Phishing Tactics - Unit 42
https://unit42.paloaltonetworks.com/apt29-evolving-diplomatic-phishing/
Cloaked Ursa Resurfaces with ROOTSAW Malware - Unit 42
https://unit42.paloaltonetworks.com/cloaked-ursa-rootsaw-malware/
APT29 Targets Government and Political Entities with WINELOADER
https://www.zscaler.com/blogs/security-research/apt29-targets-government-and-political-entities-wineloader
NCSC and partners issue advisory on APT29 targeting of vulnerable network devices
https://www.ncsc.gov.uk/news/advisory-apt29-targeting-vulnerable-network-devices
Microsoft Threat Intelligence - Midnight Blizzard Profile
https://www.microsoft.com/en-us/security/blog/threat-intelligence/threat-actor/midnight-blizzard/
Mandiant: Highly Evasive Attacker Leverages SolarWinds Supply Chain
https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
Microsoft: Nobelium Targeting Delegated Administrative Privileges
https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/