Recent trends throughout the threat landscape show a significant rise in credential theft targeting residential individuals to government organizations. One of the threat organizations involved in this surge is the Russian-aligned Midnight Blizzard threat group. This threat group, tracked under numerous monikers including APT29 and BlueBravo, has gained attention from its major operations including the SolarWinds supply chain compromise, espionage acts against the Democratic National Committee, as well as various government, foreign ministries, and diplomatic organizations. Midnight Blizzard continues to maintain a strong connection with the Russian Foreign Intelligence Service (SVR), who are known for their electronic surveillance and cyberespionage efforts against those opposing Russia. In its recent campaign, Midnight Blizzard actors have utilized numerous credential access methods to exploit and infiltrate public-facing infrastructure through the use of session replay, brute force, token theft, and password spraying attacks. To increase their chances of successful attacks with low/no detection, Midnight Blizzard actors incorporate residential proxy services into their operations to minimize network detection. The group has also been known to target users with specific vulnerabilities on their systems including the older Roundcube vulnerabilities (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026) and the recent Microsoft Outlook zero-day CVE-2023-23397. Lastly, the primary delivery sought by Midnight Blizzard actors comes through socially engineering their target(s) with news-themed spear-phishing attacks related to the Russia/Ukraine conflict. CTIX continues to monitor threat groups worldwide and reminds users to ensure the integrity of any digital communications prior to visiting embedded URL’s or downloading attachments.