Subgroup of Russia’s Sandworm compromising US and European organizations, Microsoft says

Microsoft Threat Intelligence attributes a multiyear global initial-access campaign called "BadPilot" to a Sandworm/Seashell Blizzard subgroup that has been exploiting multiple public vulnerabilities and abusing remote management tools to gain and maintain access to high-value targets in energy, telecoms, shipping, manufacturing, government and other sectors across the U.S., U.K. and Europe; the subgroup’s persistent access has supported espionage and, at times, preceded destructive operations tied to the wider Sandworm cluster.