Aqua Blizzard

Aqua Blizzard, previously known as ACTINIUM, is a significant threat actor originating from Russia. Recently, Microsoft revamped its naming convention for threat groups, transitioning from all-cap names based on atomic elements to a two-name scheme inspired by storm terminology. Aqua Blizzard has been identified as a significant cybersecurity concern due to its advanced techniques, such as the successful integration of HTML smuggling into initial access phishing campaigns. This sophisticated approach reduces the likelihood of detection by antivirus signatures and email security controls, enhancing the group's ability to infiltrate systems undetected. In a recent keynote presentation at CPX 2024 in Las Vegas, Maya Horowitz, Vice President of Research at Check Point, highlighted that USBs were the primary infection vector for several major threat groups in 2023. Among these groups were China's Camaro Dragon, Russia's Gamaredon (also known as Aqua Blizzard), and the threat actors behind Raspberry Robin. These groups have demonstrated their ability to exploit various vectors and adapt to evolving security measures, posing a persistent threat to cybersecurity. Check Point provided detailed insights into Aqua Blizzard's latest tactics, characterizing the group as engaging in large-scale campaigns followed by targeted data collection efforts. These activities are believed to be motivated by espionage objectives, indicating the strategic nature of Aqua Blizzard's operations. The group's ability to conduct extensive campaigns and collect specific data underscores the sophistication of its operations and the potential risks it poses to targeted entities.