Microsoft Threat Intelligence analysts noted that Seashell Blizzard is known for its expertise in targeting critical infrastructure such as industrial control systems (ICS) and supervisory control and data acquisition systems (SCADA). These exploits have allowed Seashell Blizzard to access sensitive sectors globally, including energy, oil and gas, telecommunications, shipping, arms manufacturing, and international governments. As a result, understanding and mitigating the tactics, techniques, and procedures (TTPs) of threat actors like Seashell Blizzard is essential for protecting global networks. This subgroup has been conducting a multiyear operation to compromise Internet-facing infrastructure globally, expanding Seashell Blizzard’s reach beyond Eastern Europe. The campaign leverages opportunistic access techniques and stealthy persistence methods to collect credentials, execute commands, and facilitate lateral movement within networks. First, they deploy Remote Management and Monitoring (RMM) suites like Atera Agent and Splashtop Remote Services for persistence and command and control, often after exploiting vulnerabilities in ConnectWise ScreenConnect and Fortinet FortiClient EMS. Seashell Blizzard is a high-impact threat actor linked to the Russian Federation’s Military Intelligence Unit 74455 (GRU). Active since at least 2013, it has been involved in various operations ranging from espionage to cyber-enabled disruptions, including destructive attacks like KillDisk (2015) and NotPetya (2017). The BadPilot campaign has been active since at least 2021, focusing on compromising network devices to gain persistent access to high-value targets. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Second, they actively exploit known vulnerabilities to compromise Internet-facing systems, using third-party scanning services to identify targets. Finally, once inside a system, they engage in extensive post-compromise activities, including credential theft and lateral movement, which have, in some cases, resulted in destructive attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Feb 2025 06:30:20 +0000