Microsoft Security Blog: The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation

Feb 12, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
Source: Microsoft Security Blog
Title: The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation

Feedly Summary: Microsoft is publishing for the first time our research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the “BadPilot campaign”. This subgroup has conducted globally diverse compromises of Internet-facing infrastructure to enable Seashell Blizzard to persist on high-value targets and support tailored network operations.
The post The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

**Summary:** The text elaborates on Microsoft’s research regarding the “BadPilot campaign,” an operation conducted by the Russian state actor Seashell Blizzard. This campaign showcases the group’s evolution in accessing diverse global targets through sophisticated exploitation techniques, highlighting substantial risks to critical infrastructure and international organizations. The insights provided signify the need for enhanced security measures tailored to counteract such advanced persistent threats (APTs).

**Detailed Description:**
The document provides an extensive analysis of the “BadPilot campaign,” part of the broader activity of the Seashell Blizzard group, which is linked to Russian Military Intelligence. This analysis includes:

– **Scope of Operations:**
– Seashell Blizzard has expanded its geographical targeting from Eastern Europe to encompass a global reach, affecting sectors like energy, telecommunications, and government entities.
– The subgroup has maintained persistent access to high-value targets through various opportunistic techniques and stealthy persistence methods since at least 2021.

– **Tactics, Techniques, and Procedures (TTPs):**
– The campaign is characterized by three distinct exploitation patterns:
1. **Deployment of Remote Management and Monitoring software:** This novel technique facilitates Command and Control (C2) while masquerading as legitimate tools, reducing detection chances.
2. **Web shell deployment:** Following initial exploitation via vulnerabilities, web shells are used to maintain footholds and execute commands.
3. **Credential collection through compromised web forms and DNS modifications:** This approach aids in obtaining user credentials, facilitating further lateral movement.

– **Notable Exploits:**
– The subgroup has exploited multiple specific vulnerabilities, notably in ConnectWise ScreenConnect and Fortinet FortiClient EMS, indicating a trend towards leveraging well-known IT management tools for malicious purposes.
– It has a history of utilizing tools like Cobalt Strike, as well as custom deployments like their LocalOlive web shell, reflecting their adaptive strategies.

– **Mitigation Strategies:**
– The report emphasizes the importance of implementing vulnerability management systems, multifactor authentication (MFA), and other security measures to counteract these threats. Specific recommendations include:
– Monitoring and disabling unnecessary remote management tools.
– Strengthening endpoint security configurations, particularly with Microsoft Defender tools.
– Conducting regular audits for vulnerabilities in commonly used software.

– **Threat Landscape Awareness:**
– The text represents a call to action for organizations worldwide to stay vigilant against such evolving threats, underscoring the need for proactive security postures supported by up-to-date threat intelligence.

In conclusion, the insights gathered from the analysis of the “BadPilot campaign” provide critical intelligence for security and compliance professionals, emphasizing the necessity for robust cybersecurity frameworks and rigorous monitoring practices to protect against sophisticated state-sponsored cyber threats.

1 2 3 5 a access Act adaptive advanced persistent threat advanced persistent threats AGI AI analysis and anti Arch art as audit Audits authentication awareness BadPilot campaign by C C2 client Cobalt Strike Col command communication compliance compliance professionals Configuration configurations control credential credential collection credentials critical critical infrastructure cyber cyber threat cyber threats cybersecurit Cybersecurity cybersecurity framework cybersecurity frameworks D de deployment detection DNS document e end endpoint endpoint security energy enhanced security enhanced security measures EU Europe evolving threats exp exploit Exploitation exploitation techniques exploits fact factor authentication factor authentication (MFA) first for Fortinet framework frameworks g Gen geo git global reach Go government government entities graph Group high Highlight HR http HTTPS in infrastructure initial access insights Intel intelligence inter intern International Organizations internet IRS ite k l Labor land lateral movement least led Link linked low man management management and monitoring Management System management tools MFA Micro Microsoft Microsoft Defender Microsoft Security Microsoft Threat Intelligence military military intelligence mitigation mitigation strategies ModI Monitor monitoring Monitoring Practices monitoring software multi multifactor authentication nation network NIST no o of on operation organization organizations ory over patterns phi point post pre proactive proactive security proactive security posture procedures professionals publishing R rack rag rate RCE recommendations red report research Risk risks Ro RoT Russia Russian military Russian state actor s search Seashell Blizzard sec security security and compliance security configurations security framework security frameworks security measure security measures security posture security postures Sig software source sponsored sponsored cyber threats state state-sponsored state-sponsored cyber threats stealth stealthy system systems T tactics tech techniques telecom telecommunications text the threat threat intel threat intelligence threat landscape threats Time to tool tools Tor TP two up US use user user credentials uth V val vulnerabilities vulnerability Vulnerability Management web web forms web shell web shell deployment web shells Well Wi x