APT29 (Cozy Bear, SVR)

On April 15, 2021, the White House formally attributed the SolarWinds Orion compromise to the SVR, Russia's foreign intelligence service, together with sanctions under a new presidential order, Executive Order 14024. The group in question is APT29 at Mandiant, Cozy Bear at CrowdStrike, Nobelium then Midnight Blizzard at Microsoft. Its style is that of a foreign intelligence service: patience, stealth, access held for months without breaking anything. In July 2020, the UK, the US and Canada accused it of targeting Covid vaccine research. In January 2024, Microsoft disclosed that it had read mailboxes of its own leadership, getting in through a test account without multi-factor authentication. For insurance, APT29 raises a different problem from Sandworm. It destroys almost nothing: its losses are forensics, notification and remediation costs, not massive business interruption. The state-backed attack exclusion still applies, since attribution has been made, and the insured finds that a silent intrusion is excluded just like a wiper.