Seashell Blizzard

Seashell Blizzard, also known as Iridium, Sandworm, Voodoo Bear, and APT44, is a state-sponsored threat actor group affiliated with the Russian military intelligence service (GRU). Microsoft has identified this group as distinct from other Advanced Persistent Threat (APT) groups operating under the GRU, such as Forest Blizzard (also known as Strontium, APT28, and Fancy Bear). Seashell Blizzard has been linked to several high-profile cyber-attacks, including exploiting perimeter server systems like Exchange and Tomcat servers, while leveraging pirated Microsoft Office software harboring the DarkCrystalRAT backdoor for initial access. The group is believed to be run by Military Unit 74455, a notorious cyber warfare unit of the GRU. Seashell Blizzard has exhibited a pattern of short-term collaborations with hacktivist groups such as Solntsepek, InfoCentr, and Cyber Army of Russia. These relationships are marked by temporary spikes in alleged cyber capability coinciding with Seashell Blizzard attacks. Microsoft has noted that these hacktivist-led attacks often preface multiple waves of more destructive assaults by Seashell Blizzard, supporting broader military objectives, especially in the context of conflicts like the one in Ukraine. The group has also been associated with the development of disruptive malware strains, such as NotPetya and a novel "ransomware" strain known as Prestige. The latter was discussed at CYBERWARCON 2022 and was found to impact organizations in Ukraine and Poland. In addition, Seashell Blizzard has been linked to the FakePenny ransomware, given the close overlap between the ransom notes used by both. Periodically, Seashell Blizzard launches destructive attacks, which are then publicly claimed by Telegram hacktivist groups, adding a layer of plausible deniability for the sponsoring organization.