https://en.m.wikipedia.org/wiki/Cozy_Bear
Cozy Bear, classified by the United States federal government as advanced persistent threat APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. The Dutch General Intelligence and Security Service (AIVD) deduced from security camera footage that it is led by the Russian Foreign Intelligence Service (SVR),[5] a view shared by the United States.[4] Cybersecurity firm CrowdStrike also previously suggested that it may be associated with either the Russian Federal Security Service (FSB) or SVR.[2] The group has been given various nicknames by other cybersecurity firms, including CozyCar,[6] CozyDuke[7][8] (by F-Secure), Dark Halo, The Dukes (by Volexity), Midnight Blizzard[9] (by Microsoft), NOBELIUM, Office Monkeys, StellarParticle, UNC2452, and YTTRIUM.