Malicious activities linked to the Nobelium intrusion set

ANSSI reports that the Nobelium intrusion set (also known as Midnight Blizzard), attributed to the Russian SVR, has been active since at least October 2020 and targets high-value diplomatic and IT-sector organizations for espionage. Operators use compromised legitimate email accounts and phishing lures to deliver private loaders and public tooling (e.g., Cobalt Strike), maintain persistence, and exfiltrate intelligence; recent activity includes campaigns against French diplomatic entities, breaches or email-exfiltration incidents involving Microsoft and HPE, and opportunistic exploitation of TeamCity (CVE-2023-42793). ANSSI highlights Nobelium as an ongoing, state-linked threat with published TTPs and IOCs available via partner reports.