Full Report
The BadPilot campaign operates as a horizontally scalable cyber operation, compromising a wide range of internet-facing systems using publicly available exploits. The subgroup conducts broad scanning for vulnerable systems and leverages commodity exploits to infiltrate network...
Analysis Summary
# Threat Actor: Seashell Blizzard Subgroup (Associated with BadPilot Campaign)
## Attribution & Identity
**Identification:** Identified as the "Seashell Blizzard Subgroup" operating within the broader "BadPilot campaign."
**Known Aliases/Associations:** Associated with the BadPilot campaign.
## Activity Summary
The BadPilot campaign, conducted by the Seashell Blizzard Subgroup, is described as a horizontally scalable cyber operation focused on gaining broad access to internet-facing systems. Activities date back to late 2021. The operation involves broad scanning, exploitation of public vulnerabilities for initial access, and establishing persistent covert access channels. Recent activity (early 2024) shows a shift toward deploying commercial Remote Monitoring and Management (RMM) tools.
## Tactics, Techniques & Procedures
- **Initial Access:** Vulnerability exploitation using publicly available exploits (e.g., CVE-2021-34473, CVE-2022-41352, CVE-2023-32315, CVE-2023-42793, CVE-2023-23397).
- **Persistence:** Establishing persistence via remote management tools (Atera Agent, Splashtop), web shells, and ShadowLink (using Tor hidden services).
- **Execution/Defense Evasion:** Utilizing Tunneling utilities (Chisel, rsockstun).
- **Credential Access:** Credential harvesting and modification of Outlook Web Access (OWA) login pages for credential theft.
- **Command and Control (C2):** Using Tor-based covert access mechanisms.
## Targeting
**Sectors:** Not explicitly detailed, but targeting systems like TeamCity, Zimbra Servers, Microsoft Exchange, OpenFire, and Microsoft Outlook suggests targeting organizations utilizing those platforms, often spanning private and public sectors.
**Geography:** Global access operation.
**Victims:** Specific organizations are not named; victims are characterized by the use of vulnerable, internet-facing systems.
## Tools & Infrastructure
- **Malware Families/Utilities:** Chisel, rsockstun, LocalOlive (web shell), Atera Agent (RMM), Splashtop Remote Services (RMM), ShadowLink (persistence mechanism utilizing Tor).
- **Infrastructure:** Reliance on Tor hidden services for covert access.
## Implications
This operation represents a persistent, high-volume campaign focused on initial network entry using low-cost, commodity exploits against known vulnerabilities. The shift towards deploying legitimate RMM software suggests an attempt to maintain long-term, low-profile access that is often difficult to differentiate from remote IT administration. The goal appears to be establishing durable access for potential follow-on activities, including data exfiltration (as suggested by the article's title context).
## Mitigations
- **Patch Management:** Urgently patch all internet-facing instances, prioritizing vulnerabilities mentioned (Microsoft Exchange, Zimbra, OpenFire, TeamCity, Outlook).
- **Vulnerability Management:** Monitor for exploitation attempts against ConnectWise ScreenConnect and Fortinet FortiClient EMS.
- **Network Monitoring:** Monitor egress traffic for connections established by RMM tools (Atera, Splashtop) or tunneling software (Chisel, rsockstun) to unusual destinations or over Tor.
- **Credential Protection:** Implement strong multi-factor authentication and monitor for modifications to OWA login pages.
- **Endpoint Detection:** Implement robust monitoring for the deployment of web shells (LocalOlive) and unauthorized persistence mechanisms (ShadowLink).