Cadet Blizzard

Cadet Blizzard, a Russian threat actor, has emerged as a significant cybersecurity concern. Identified by the Microsoft Threat Intelligence Center in June 2023, Cadet Blizzard is linked to Russia's GRU military intelligence unit and has been operational since at least 2020. The group has demonstrated a comprehensive approach to its cyber activities, maintaining an extended risk of compromise within targeted networks. Their operations have included destructive cyber attacks, particularly in Ukraine, utilizing wiper malware to cause extensive damage. In the lead-up to Russia's invasion of Ukraine, Cadet Blizzard was identified as responsible for deploying wiper malware. Furthermore, the group has been implicated in defacements of Ukrainian organization websites and the hack-and-leak Telegram channel "Free Civilian." Microsoft has tracked Cadet Blizzard since January 2022, noting that it targets government organizations and IT providers not only in Ukraine but also across Europe and Latin America. Notably, the group has received support from at least one Russian private sector organization, demonstrating its extensive network and resources. Cadet Blizzard has leveraged several vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708, CVE-2023-34363, CVE-2023-34364) to exploit target software MOVEit Transfer and Windows systems. The group has also utilized various forms of malware, including Clop ransomware and LEMURLOOT webshell, employing techniques such as SQL injection. Its threats have ranged from data leaks to extortion, affecting multiple countries including the US, UK, and Canada. As a result, Cadet Blizzard represents a substantial and diverse threat to global cybersecurity.