Sandworm, also known as Russia's Military Unit 74455 within the GRU, has established itself as one of the most notorious advanced persistent threats (APT). Its cyber operations have included NotPetya, the attack on the 2018 Winter Olympics, and two successful assaults on Ukraine’s power grid. More recent campaigns have targeted Denmark’s energy sector and attempted—both unsuccessfully and successfully—to disrupt Ukraine’s grid once again.
Recent developments indicate a shift in Sandworm’s tactics, moving toward quieter, more extensive intrusions. Microsoft, tracking the group under the name "Seashell Blizzard," has identified a specific subgroup within Unit 74455 that focuses exclusively on breaching high-value organizations. Dubbed "BadPilot," this subgroup has been executing opportunistic cyberattacks on Internet-facing infrastructure since at least late 2021, leveraging known vulnerabilities in widely used email and collaboration platforms.
Among the critical vulnerabilities exploited by BadPilot are Zimbra's CVE-2022-41352, Microsoft Exchange's CVE-2021-34473, and Microsoft Outlook's CVE-2023-23397. All three have received a severity score of 9.8 out of 10 under the Common Vulnerability Scoring System (CVSS), indicating their high impact.
BadPilot’s primary targets include telecommunications, oil and gas, shipping, arms manufacturing, and foreign government entities, spanning Ukraine, Europe, Central and South Asia, and the Middle East. Since early 2024, operations have expanded to the United States and the United Kingdom, with a particular focus on vulnerabilities in remote monitoring and management (RMM) software. Exploited vulnerabilities include CVE-2023-48788 in Fortinet Forticlient Enterprise Management Server (EMS) and CVE-2024-1709, a critical authentication bypass flaw in ScreenConnect by ConnectWise, rated a perfect 10 on the CVSS scale.
Upon breaching a system, BadPilot follows a systematic approach to maintain persistence and escalate its control. It deploys the custom "LocalOlive" Web shell and uses legitimate RMM tools under the name "ShadowLink" to configure compromised systems as Tor hidden services. The group collects credentials, moves laterally across networks, exfiltrates data, and engages in post-compromise activities.
“There is not a lack of sophistication here, but a focus on agility and obtaining goals,” says Sherrod DeGrippo, director of threat intelligence strategy at Microsoft. “These TTPs work because this threat actor is persistent and continues pursuing its objectives.”
BadPilot’s operations serve as a crucial enabler for Sandworm’s broader cyberattacks, aligning with Russia’s strategic objectives. Microsoft notes that "its compromises cumulatively offer Seashell Blizzard options when responding to Russia's evolving strategic objectives."
The subgroup emerged just months before Russia's invasion of Ukraine, actively contributing to cyberattacks aimed at organizations providing political or military support to Ukraine. Since 2023, BadPilot has facilitated at least three destructive attacks in the country.
Throughout the war, Sandworm has persistently targeted Ukraine’s critical infrastructure, including telecommunications, manufacturing, transportation, logistics, energy, water, and military organizations, as well as civilian support systems. Intelligence-gathering operations have also extended to military communities.
“These threat actors are persistent, creative, organized, and well-resourced,” DeGrippo emphasizes. To mitigate risks, "critical sectors need to ensure that they sustain above-average security practices, patch their software, monitor Internet-facing assets, and enhance their overall security posture."