A hacker group violates Western networks within Russia’s infamous Sandworm unit

The most aggressive cyberscari unit of the Kremlin has been known in the last ten years SandwormSince the full-time Russian neighborhood occupation of Russian President Vladimir Putin’s neighbor, he focused on the suffering of Haji campaigns. Microsoft warns that this notorious Hacking team has changed the target’s target for violation of networks around the world, which seems special interest in networks in English-speaking Western countries.

On Wednesday, Microsoft’s threatening group published a new investigation into a group within SanDworm, where the company’s analysts called Badpilot. Microsoft describes the team as a “primary access operation” as the “initial access operation”, and other hackers in the victims, SANDWORL provides access to a larger organization of SANDWORM, which is determined by the Russian GRU military intelligence agency Evaluates a “initial entry transaction” before. Following the preliminary violations of Badpilot, other Sandworm hackers used their intrusions to exercise the effects such as victim networks and start information or cyberatiatics.

Microsoft Badpilot describes high volume intervention attempts, pouring a wide network, then describes as sorting through the results to focus on certain victims. Over the past three years, this is the method of targeting the group, almost completely in Ukraine in 2023, he said in 2023 and then slides the house in the United States, England, Canada and Australia.

“We see that they pay attention to their attempts at the initial entrance, we focus on the goals they like, they focus on the goals they like,” Sherrot Degripo, Director of Microsoft’s threatening strategy. “They choose the meaning of the meaning and choose. And they pay attention to these Western countries.”

Microsoft did not call any special victims of the Badpilot’s interventions, but the targets of the hacker group “Energy, oil, oil, telecommunications, ship production, weapons, weapons” and “international governments” reported. At least three cases, Microsoft says that his operations were said to say cyberaxis, which destroyed the information carried out by Sandworm against Ukrainian targets.

As for the spotlight on Western networks, Microsoft’s DEGRIrtos shows that the group’s interests are more politics. “Global elections are probably a reason for this,” DeGrip said. “Changing the political landscape, I think it is a motivator to change tactics and change targets.”

More than three years of Microsoft watched the badpilot, in groups, Microsoft Exchange and Outlook, as well as Microsoft exchange and outlook, as well as the use of Microsoft exchange and outlook, as well as non-known flaws, also used the unknown defects, as well as non-known defects, as well as the unknown defects, also Openfire, Jetbrens and Zimbra . Especially when targeting Western networks, Microsoft, Badpilot, Remote Introduction Connectwise ScreenConnect and Fortinet Forticlient EMS, Fortinet’s Security Program, Fortinet’s security program to manage Fortinet’s security program warns a sensitivity to another application.

After exploiting these vulnerabilities, Microsoft, Badpilot has usually found a program that allows a victim’s machine that has legal remote accesses such as Aterera Agent or Splahtop remote services. In some cases, it also builds a victim’s computer in a more unique twisting, a tored network to manage the words in the anonymity network, in fact, transforms it into a server that converts it to a server connecting proxy cars.