Russian Sandworm Subgroup Expands Global Cyberattack Campaign

Russian state threat group shifts focus to US, UK targets

A subgroup of Seashell Blizzard has shifted its focus to targets in the U.S., Canada, Australia and the U.K. within the past year, expanding the scope of its malicious activity, Microsoft’s threat intelligence team said in a report released Wednesday. The initial-access operation, which Microsoft tracks as the “BadPilot campaign,” has allowed the Russian state threat group — commonly known as Sandworm, which operates on behalf of the Russian Mil…

Microsoft fingers Russia's Sandworm in US, UK attacks

'Near-global' initial access campaign active since 2021

A Hacker Group Within Russia’s Notorious Sandworm Unit Is Breaching Western Networks

A team Microsoft calls BadPilot is acting as Sandworm's “initial access operation,” the company says. And over the last year it's trained its sights on the US, the UK, Canada, and Australia.

BadPilot network hacking campaign fuels Russian SandWorm attacks

A subgroup of the Russian state-sponsored hacking group APT44, also known as 'Seashell Blizzard' and 'Sandworm', has been targeting critical organizations and governments in a multi-year campaign dubbed 'BadPilot.'

Sandworm APT's initial access subgroup hits organizations accross the globe - Help Net Security

A subgroup of Russia’s Sandworm APT has been working to achieve initial and persistent access to the IT networks of organizations working in economic sectors Russia is interested in. “In 2022, its primary focus was Ukraine, specifically targeting the energy, retail, education, consulting, and agriculture sectors. In 2023, it globalized the scope of its compromises, leading to persistent access within numerous sectors in the United States, Europe…

The cybersecurity teams at Microsoft have noticed the emergence of a new group of pirates linked to Russian military intelligence. These pirates are close to a unit known for its destructive attacks. For more than a decade, Sandworm, the Kremlin's most aggressive cyber-war unit, has been leading cyber-security