(PatriotsUnited.org) – A new analysis has highlighted how a major cyber group could pose risks to French national security as the country gears up for a presidential election and the Olympic and Paralympic Games. Nobelium, also dubbed “Midnight Blizzard,” is notorious for its attacks on the SolarWinds supply chain in 2021. This group, linked to Russian intelligence, is now seen as a distinct entity that emerged in October 2020, separate from the earlier known APT29 group.
The report emphasizes that Nobelium’s primary targets are diplomats and ministry officials. The group uses sophisticated phishing emails, often sent from previously compromised foreign institutions, to breach the email accounts of diplomatic staff, embassies, and consulates. This method, known as business email compromise (BEC), has been repeatedly used against French public sector entities, including the Ministry of Foreign Affairs.
Between February and May 2021, Nobelium cyber-attacked the French Ministry of Foreign Affairs, attempting to deploy Cobalt Strike for remote access. Although this attempt was unsuccessful, it was one of many serious efforts to infiltrate the French government. Further attacks followed in 2022, with phishing emails themed around diplomatic events. In May 2023, French embassies in Ukraine and Romania were targeted with lures themed around selling a diplomatic car.
The new report states that the activities against French diplomatic entities are consistent with Nobelium’s usual tactics. The tools and infrastructure used show similarities with other campaigns by this malign actor, and the persistent targeting indicates state-linked involvement. The timing of this report, just before France’s election, suggests more than mere coincidence. There is clear concern about imminent potential Russian interference. The report concludes that Nobelium poses a clear threat to national security and the diplomatic interests of France and its neighbors.
Russia’s influence operations in France are not new, with Paris’ European Affairs Minister recently claiming Moscow was behind a disinformation strategy to target President Emmanuel Macron, highlighting a bed bug scare in Paris allegedly amplified by Russian bots. This follows the 2017 “Macron Leaks,” where Moscow-linked hackers breached Macron’s computer and leaked documents to prompt social divisions and political disagreements. Although this attempt failed, it remains a stark reminder of the ongoing threat. In the private sector, ongoing disinformation campaigns targeting upcoming sports events have been exposed. Using both fake news and so-called “deepfake” edits, efforts are being distributed, along with accusations about Macron’s political views.
Copyright 2024, PatriotsUnited.org
