Just Another Blue Teamer<p>Good day everyone, new Blizzard has dropped!</p><p>Microsoft's Threat Intelligence shares their research on a Russian state actor dubbed <a href="https://ioc.exchange/tags/SeashellBlizzard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SeashellBlizzard</span></a>! Part of the GRU, they specialize in operations from espionage to information operation and cyber-enabled disruptions which have resulted in destructive attacks and manipulation of ICS. They have leveraged different types of malware to include <a href="https://ioc.exchange/tags/KillDisk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KillDisk</span></a>, <a href="https://ioc.exchange/tags/FoxBlade" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FoxBlade</span></a>, and <a href="https://ioc.exchange/tags/NotPetya" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NotPetya</span></a>. </p><p>Behavior Summary (With MITRE ATT&amp;CK):<br>Initial Access - TA0001:<br>Exploit Public-Facing Application - T1190<br>Seashell Blizzard commonly exploited vulnerable public facing infrastructure. </p><p>Persistence - TA0003:<br>Create or Modify System Process: Windows Service - T1543.003 -<br>Among other means of persistence, Seashell Blizzard created a system service.</p><p>Execution - TA0002:<br>Command and Scripting Interpreter: PowerShell - T1059.001<br>Command and Scripting Interpreter: Windows Command Shell - T1059.003<br>Seashell Blizzard abused both of these living off the land binaries for multiple reasons and using multiple different parameters. </p><p>As always, there is WAAAAY too many technical details here, so go check it out yourself! Enjoy the read and Happy Hunting!</p><p>The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation<br><a href="https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">microsoft.com/en-us/security/b</span><span class="invisible">log/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>