Microsoft Threat Intelligence Podcast BadPilot: Inside Seashell Blizzard’s (AKA Sandworm) Global Cyber Espionage Campaign
8 snips
May 14, 2025 Security researchers Anna Seitz and Megan Stalling from Microsoft dive deep into the BadPilot Campaign, revealing its ties to the notorious Seashell Blizzard group. They discuss how this subgroup targets industrial control systems using sneaky tactics like fake Zoom links to lure victims. The conversation highlights the importance of network detection in countering these evolving threats and explores the sophisticated social engineering techniques employed by North Korean hackers. This insightful dialogue uncovers the fascinating intersection of cyber espionage and technological adaptation.
AI Snips
Chapters
Transcript
Episode notes
Seashell Blizzard Targets ICS
- Seashell Blizzard primarily targets industrial control systems, focusing on espionage and disruption aligned with Russian military objectives.
- Their long history since 2013 includes infamous campaigns like NotPetya and Foxblade.
BadPilot Focuses on Initial Access
- The BadPilot subgroup of Seashell Blizzard specializes in gaining initial access and holding footholds with opportunistic tactics.
- Their use of remote management software aids persistence and lateral movement for potential large network compromises.
Shared TTPs Across Threat Actors
- The subgroup uses basic tactics like exploiting known vulnerabilities, similar to chinesethreat actor methods targeting SOHO and enterprise devices.
- This signals a broader trend of technique diffusion and evolving threat actor ecosystems.