Cadet Blizzard

Cadet Blizzard, a threat actor group associated with Russia's GRU military intelligence unit, has been identified by Microsoft as the perpetrator of destructive cyber attacks in Ukraine using wiper malware. The group has been active since at least 2020 and has recently gained some success, according to Microsoft researchers. Notably, Cadet Blizzard was attributed to the WhisperGate attacks in mid-2023, which were part of the cyber onslaught leading up to Russia's invasion of Ukraine. Furthermore, Cadet Blizzard is linked to defacements of Ukrainian organization websites and the hack-and-leak Telegram channel “Free Civilian.” The group has demonstrated a comprehensive approach to its activities, maintaining networks at risk of continued compromise for extended periods. Cadet Blizzard reportedly conducted lateral movement within compromised networks using obtained credentials and modules from the Impacket framework. Command and control (C2) was achieved via socket-based tunneling utilities and occasionally Meterpreter. The group has received support from at least one Russian private sector organization and has targeted government organizations and IT providers in Ukraine, Europe, and Latin America. From a technical standpoint, Cadet Blizzard predominantly achieved initial access by exploiting web servers and vulnerabilities in Confluence servers, Exchange servers, and open-source platforms. The group utilized various types of malware, including Clop and LEMURLOOT, and employed techniques such as SQL injection. The group also exploited several vulnerabilities, including CVE-2023-34362, CVE-2023-35036, CVE-2023-35708, CVE-2023-34363, and CVE-2023-34364. The primary targets of these attacks were systems running MOVEit Transfer software on Windows, with the US, UK, and Canada being the most affected countries.