Russian hacking group targets critical infrastructure in the US, the UK, and Canada – Source: www.csoonline.com

A Russian state-backed hacking group is executing one of the most far-reaching cyber espionage campaigns ever seen, infiltrating critical infrastructure across multiple continents by exploiting vulnerabilities in IT management software.

The operation, attributed to the notorious Russian threat actor Seashell Blizzard, has compromised high-profile targets in energy, telecommunications, defense, and government sectors, including in the US, Canada, Australia, and the UK, Microsoft said in a report.

The software major has warned that the scale and persistence of these attacks pose an immediate and severe risk to global cybersecurity.

“Active since at least 2021, this subgroup within Seashell Blizzard has leveraged opportunistic access techniques and stealthy forms of persistence to collect credentials, achieve command execution, and support lateral movement that has at times led to substantial regional network compromises,” Microsoft said in the report.

Seashell Blizzard’s activities align with those tracked by other security vendors under various names, including BE2, UAC-0133, Blue Echidna, Sandworm, PHANTOM, BlackEnergy Lite, and APT44.

Russian cyber warfare expands beyond Ukraine

The hacking subgroup tracked as the “BadPilot campaign,” has been active since at least 2021, originally focusing on Ukraine and Europe. Microsoft reports that the operation has now extended its reach into North America, Central Asia, and the Middle East.

“The geographical targeting to a near-global scale expands Seashell Blizzard’s operations beyond Eastern Europe,” said the report.

Seashell Blizzard, linked to Russia’s Military Intelligence Unit 74455 (GRU), has a long history of cyberespionage and destructive cyberattacks aligned with Kremlin interests.

This latest campaign demonstrates the group’s growing sophistication in leveraging stealth tactics and opportunistic access methods to gain control of high-value networks.

Weaponizing IT software against global enterprises

Since early 2024, the hackers have exploited vulnerabilities in widely used IT management tools, including ConnectWise ScreenConnect (CVE-2024-1709) and Fortinet FortiClient EMS (CVE-2023-48788). By compromising these critical enterprise systems, the group has gained undetected access to networks, Microsoft warned.

“Seashell Blizzard’s specialized operations have ranged from espionage to information operations and cyber-enabled disruptions, usually in the form of destructive attacks and manipulation of industrial control systems (ICS),” the report said. “The opportunistic access methods outlined in this campaign will continue to offer Russia opportunities for niche operations and activities.”

The group’s evolving tradecraft has made its attacks increasingly difficult to detect, allowing it to establish persistent footholds in high-profile targets worldwide.

Some of the notorious attacks of the subgroup include destructive attacks such as KillDisk and FoxBlade, supply-chain attacks such as MeDoc, and pseudo-ransomware attacks such as NotPetya and Prestige, Microsoft noted in the report.

Mounting cyberattacks signal a growing threat to enterprises

Microsoft has linked the subgroup to at least three destructive cyberattacks in Ukraine since 2023, underscoring the severity of its operations. The report highlights that while some attacks appear indiscriminate, the overall strategy provides Russia with valuable cyber access for future military and intelligence operations.

“Since April 2022, Russia-aligned threat actors have increasingly targeted international organizations that are either geopolitically significant or provide military and/or political support to Ukraine,” Microsoft noted.

The targeted industries include arms manufacturing, shipping, and energy—sectors critical to national security and geopolitical stability. The campaign’s expanding reach signals an urgent need for stronger cybersecurity measures among enterprises and governments.

“Due to their specialization in computer network exploitation (CNE) and expertise targeting critical infrastructure such as ICS and supervisory control and data acquisition systems (SCADA), Seashell Blizzard’s operations have frequently been leveraged during military conflicts and as an adaptable element during contentious geopolitical events,” the report added.

The report said that Microsoft is actively tracking Seashell Blizzard’s operations and notifying affected organizations. It also urged enterprises to take immediate action by patching known vulnerabilities, enforcing network segmentation, and adopting a zero-trust security framework. “Security teams should monitor for suspicious activity and review logs for indicators of compromise linked to Seashell Blizzard’s evolving attack methods,” Microsoft suggested in the report.