Russia's Sandworm caught snarfing credentials, data from American and Brit orgs

An initial-access subgroup of Russia's Sandworm last year wriggled its way into networks within the US, UK, Canada and Australia, stealing credentials and data from "a limited number of organizations," according to Microsoft. Sandworm, the offensive cyber operations group that works for the Russian Military Intelligence Unit 74455 (GRU), has previously been linked to attacks on water facilities in the US and EU, the 2018 Winter Olympics, NotPetya, and various other destructive attacks on Ukraine's critical infrastructure. In a report published today, Redmond says a subgroup of Sandworm (Microsoft's threat intel team tracks Sandworm as "Seashell Blizzard") has been carrying out a "near-global" initial access campaign dubbed "BadPilot" since at least 2021. The crew uses several methods to compromise victims' internet-facing infrastructure and gain access to critical sectors including energy, oil and gas, telecommunications, shipping, arms manufacturing, and international governments. And while its initial focus was Ukraine, by 2023 the BadPilot campaign had achieved persistent access to "numerous" high-value sectors in the US, Europe, Central Asia and the Middle East. A year later, it "honed its focus" on US, UK, Canada and Australian victims, we're told. "Microsoft Threat Intelligence assesses that Seashell Blizzard uses this initial access subgroup to  horizontally scale their operations as new exploits are acquired and to sustain persistent access to current  and future sect...