Seashell Blizzard Iridium

Seashell Blizzard Iridium, also known as Sandworm, is a threat actor reportedly comprised of Russian military intelligence officers. This group has been identified as distinct from other Advanced Persistent Threat (APT) groups associated with the Russian military intelligence GRU, such as Forest Blizzard (also known as Strontium, APT28, and Fancy Bear) and Cadet Blizzard. Seashell Blizzard Iridium has conducted a series of disruptive cyber operations, often under the guise of ransomware attacks, to support broader military objectives, particularly in Ukraine. At CYBERWARCON 2022, Microsoft highlighted the development of a novel "ransomware" strain, Prestige, by Seashell Blizzard Iridium. This cyberattack was designed to cause significant disruption while providing plausible deniability for the sponsoring organization. The attack impacted organizations in Ukraine and Poland, further indicating the group's focus on this region. Despite these activities, Microsoft noted that Seashell Blizzard Iridium's success rate was relatively low compared to other GRU-affiliated actors. In addition to the ransomware attacks, Seashell Blizzard Iridium has been implicated in other malicious activities. These include the WisperGate data-wiping attacks that began on January 13, 2022, over a month before Russia invaded Ukraine. The group has also been linked to a series of defacements of Ukrainian organization websites and various operations, including the hack-and-leak forum known as "Free Civilian." It's important to note that despite their common affiliation with the GRU, the operations of Cadet Blizzard are separate from those of well-established hacker groups like Forest Blizzard (Strontium) and Seashell Blizzard (Iridium).