FlagThis

A subgroup of the Russian state-sponsored hacking group APT44, also known as Seashell Blizzard and Sandworm, has been targeting critical organizations and governments in a multi-year campaign dubbed BadPilot. The group conducts globally diverse compromises of Internet-facing infrastructure to enable Seashell Blizzard to persist on high-value targets and support tailored network operations, gaining initial access to dozens of strategically important organizations across the U.S. and Europe.

The Sandworm group, a Russian military cyber-espionage unit, is actively targeting Windows users in Ukraine. They are distributing trojanized versions of Microsoft Key Management Service (KMS) activators and fake Windows updates to compromise systems. This campaign highlights the ongoing cyber warfare efforts by Russian actors and the potential risks associated with using unofficial activation tools.