Microsoft Issues a Warning Regarding a New State-Sponsored Hacker Group in Russia With Negative Intent

The General Staff Main Intelligence Directorate (GRU), according to Microsoft, is linked to Cadet Blizzard, a newly detected Russian threat actor. Due to its disruptive actions, the group's distinguishing designation has been given by the tech giant's Threat Intelligence division, which was previously tracking it as DEV-0586. Microsoft claims that despite Cadet Blizzard's high risk, it has less operational security than more established and sophisticated Russian outfits like Seashell Blizzard and Forest Blizzard.

                                                

First discovered in January 2022, Cadet Blizzard committed in damaging cyberattacks against Ukraine, mainly employing a special malware called WhisperGate or PAYWIPE, a wiper. These assaults took place in the days before Russia's armed invasion of Ukraine. According to Microsoft, Cadet Blizzard, a state-sponsored entity, has a history of planning damaging attacks, espionage, and information operations largely targeted at targets in Central Asia, the Ukraine, Europe, and occasionally Latin America.

Cadet Blizzard, which is thought to have been active since at least 2020, primarily targets emergency services, police enforcement, non-profit and governmental organisations, government entities, and IT service providers. To reduce detection, the threat actor works seven days a week, primarily during the off-peak times of its main targets. In order to increase the possible impact of its initiatives, Microsoft's Tom Burt emphasises that Cadet Blizzard also focuses on NATO member states participating in providing military assistance to Ukraine.

It is important to note that Cadet Blizzard shares similarities with other threat actors that the larger cybersecurity community is already keeping an eye on, such as Ember Bear (CrowdStrike), FROZENVISTA (Google TAG), Nodaria (Symantec), TA471 (Proofpoint), UAC-0056 (CERT-UA), and UNC2589 (Google Mandiant). This shows how widely the threat actor's actions have been acknowledged by the cybersecurity community.

Cadet Blizzard uses a variety of weapons and tactics in addition to WhisperGate in its attacks. These include SaintBot, OutSteel, GraphSteel, GrimPlant, and Graphiron, which was most recently included. SaintBot and OutSteel are attributed by Microsoft to Storm-0587, a similar activity cluster. The group is renowned for hacking and maintaining the hack-and-leak forum known as "Free Civilian." They are also notorious for vandalising the websites of Ukrainian organisations.

After getting initial access, Cadet Blizzard uses living-off-the-land (LotL) strategies to do lateral movement, gather credentials and other important information, and use tools for defence evasion and persistence. To carry out its cyberattacks, the organisation takes use of vulnerable web servers with known vulnerabilities, including Microsoft Exchange Server and Atlassian Confluence.

Microsoft cautions that Cadet Blizzard poses a rising risk to the larger European community as the fight goes on, particularly in the event of successful strikes against governments and IT service providers. Attacks of this nature give the threat actor tactical and strategic understanding about Western actions and strategies related to the crisis in Ukraine.

Cadet Blizzard's rise highlights how persistent and dynamic state-sponsored cyber threats are. It serves as a reminder of the value of vigilance, strong cybersecurity measures, and global collaboration in identifying, mitigating, and responding to such actors to protect vital infrastructure and maintain national security.