CyberzSOC

The Federal Bureau of Investigation (FBI), the The authoring agencies recommend the following mitigations to protect their networks. Mission Force (CNMF), and the United See the Mitigations section for the complete Kingdom’s National Cyber Security Centre (NCSC-UK) are releasing this joint Cybersecurity Advisory (CSA) to highlight the tactics, • Reduce attack surface by disabling techniques, and procedures (TTPs) employed by Internet-accessible services that you do the Russian Federation’s Foreign Intelligence not need, or restrict access to trusted Service (SVR) in recent cyber operations and networks, and removing unused provide network defenders with information to applications and utilities from help counter SVR cyber threats. workstations and development Since at least 2021, Russian SVR cyber actors – also tracked as APT29, Midnight Blizzard authentication whenever possible. (formerly Nobelium), Cozy Bear, and the Dukes – have consistently targeted US, European, and and applications with administrative global entities in the defense, technology, and access to email for unusual activity. finance sectors to collect foreign intelligence and enable future cyber operations, including in support of Russia’s ongoing invasion of Ukraine since February 2022. Their operations continue to pose a global threat to government and private sector organizations.