Cozy Bear, also known as APT29, is a Russian‑linked advanced persistent threat group believed to be associated with Russia’s foreign intelligence service. Active since at least 2008, the group has focused on cyber espionage, targeting government entities, critical infrastructure, and high‑value private‑sector organizations around the world. DomainTools software helped defenders investigate and track Cozy Bear by supplying deep domain‑level intelligence, including historical DNS data, WHOIS enrichment, and risk‑based signals tied to the group’s infrastructure. This enabled security teams to connect malicious domains to known Cozy Bear campaigns, identify newly registered look‑alike domains, attribute activity more quickly, and strengthen defenses against phishing, credential‑harvesting, and

Join for free to read