A highly sophisticated Russian threat actor known as Seashell Blizzard (also tracked as APT44, Sandworm, and Voodoo Bear) has been conducting extensive cyber operations against organizations worldwide. The group’s strategic focus on sectors including energy, telecommunications, government, military, transportation, manufacturing, and retail indicates a comprehensive approach to cyber espionage and potential sabotage. Their evasion tactics include leveraging Windows Background Intelligent Transfer Service (BITS) to quietly download payloads using system idle bandwidth, making malicious activities harder to detect among legitimate network traffic. Recently, AttackIQ security analysts identified a new campaign dubbed “BadPilot,” which represents a sophisticated, long-running operation primarily focused on gaining initial access to targeted networks. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Linked to Russian Military Intelligence Unit 74455 (GRU), this adversary has targeted critical sectors across the United States, Canada, Australia, Europe, Central Asia, and the Middle East since at least 2009. This is accomplished using native Windows tools, as evidenced by the group’s use of the “sc” command line utility to create new services and verify their successful implementation. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Seashell Blizzard maintains access across system restarts and credential changes by creating or modifying Windows services. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Their operations are characterized by persistent, long-term network access using both publicly available and custom-developed hacking tools. Seashell Blizzard has demonstrated particular interest in Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems. A sophisticated web skimming campaign that employs a novel technique leveraging Stripe's legacy API to validate payment card details before exfiltration. The campaign employs strategic spear-phishing emails and vulnerability exploitation to establish footholds that enable further network penetration. Their attacks have resulted in significant disruptions to critical infrastructure, particularly energy distribution systems, with potential for catastrophic consequences.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 14:40:17 +0000