Threat Overview - BadPilot Campaign

Researchers at Microsoft published an analysis of a subgroup within infamous Russian state-sponsored actor Seashell Blizzard conducting a campaign code named BadPilot since 2021. During this campaign, the subgroup compromised internet-facing infrastructure in order to gain and establish persistence to globally diverse high-value targets, including energy, telecommunications, shipping, arms manufacturing and international government entities. The threat actor initially concentrated their efforts on Ukraine and eventually expanded globally, targeting entities in the United States, United Kingdom, Canada and Australia. Seashell Blizzard expanding beyond their usual Eastern European activity is important that the community takes note of, as the threat group is considered highly sophisticated with a diverse spectrum of capabilities that consist of cyber espionage to the destruction of targeted systems. The subgroup conducting BadPilot has been observed to be exploiting known vulnerabilities, such as CVE-2024-1709 (ConnectWise ScreenConnect) and CVE-2023-48788 (Fortinet FortiClient EMS), as well as abusing remote access tools such as Atera Agent and Splashtop Remote Services to maintain access. Due to the observed reach of the BadPilot campaign reaching a global scale, it is important that organizations prepare themselves and stay on top of the activity related to this subgroup going forward.

TITAN References: TITAN Profile Report: Seashell Blizzard

Related Hunt Package Collection: Seashell Blizzard Threat Group

• Download the Report

Get your FREE Community Account today on the HUNTER Platform and get access to behavioral threat hunting content for your SIEM, EDR, NDR, and XDR platforms!

• Get Your HUNTER Community Account

Suspicious BITS Activity - ScriptBlock

This package identifies activity in Powershell Logging associated with BITS either with bitsadmin.exe or the BITS cmdlets and module in PowerShell.
ACCESS HUNT PACKAGE

Suspicious BITS Activity

This package identifies activity associated with BITS either with bitsadmin.exe or the BITS cmdlets and module in powershell.
ACCESS HUNT PACKAGE

Single Character Batch Script File Executed on Endpoint

The provided logic looks for single character batch script (.bat) file names found in the command line arguments of a process execution. This is often malicious activity as single character script files are uncommon in an environment when executed for legitimate purposes.
ACCESS HUNT PACKAGE

Potential Exfiltration - Common Rclone Arguments

This will identify processes executed with common arguments associated with rclone activity used to exfiltrate.
ACCESS HUNT PACKAGE

CertUtil file download

Identify suspicious downloads with the built-in windows tool CertUtil. CertUtil is typically not utilized to download executables or files in general from the web, as such its usage to download files from the Internet should be considered suspicious.
ACCESS HUNT PACKAGE

Suspicious Change in File or Folder Ownership - Potential Sensitive File Access or Ransomware

This Threat Hunt package identifies the use of 'takeown.exe' to modify files ownership enabling further interaction with those files. This technique can be utilized by malware and ransomware in order to access sensitive files to steal or to unlock so they can be encrypted.
ACCESS HUNT PACKAGE

Methods for Downloading Files with PowerShell

This threat hunt package identifies instances where PowerShell is being used to download files from external sources, a common technique used in malware delivery and lateral movement. The hunt examines various methods by which PowerShell can be leveraged for file downloads, including the use of cmdlets such as Invoke-WebRequest (iwr), Invoke-RestMethod (irm), and Start-BitsTransfer (sbt), as well as direct utilization of .NET classes like System.Net.WebClient and HttpClient. The package also checks for potentially suspicious use of aliases (curl, wget) and other common executables that invoke PowerShell scripts to download malicious payloads.
ACCESS HUNT PACKAGE

Remote Atera Agent Download - Command Line

This Threat Hunt package identifies when a tool like a lolbin is used to fetch the Atera's Remote Montoring and Management (RMM) agent directly from Atera's distribution domain.
ACCESS HUNT PACKAGE

Remote Atera Agent Download - Web

This Threat Hunt package identifies when the Atera's Remote Montoring and Management (RMM) agent is downloaded directly from Atera's distribution domain.
ACCESS HUNT PACKAGE

Attempted Credential Dump From Registry Via Reg.exe

This use case attempts to find execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
ACCESS HUNT PACKAGE

Dump LSASS via Renamed procdump

Identify ProcDump usage as a means to dump LSASS data. ProcDump is a SysInternals tool that can be used to dump process memory, dumping the process memory of lsass.exe which can be used to obtain credentials.
ACCESS HUNT PACKAGE