Russia's Sandworm caught snarfing credentials, data from American and Brit orgs

Microsoft observed a Sandworm initial-access subgroup (tracked as Seashell Blizzard / "BadPilot") conducting a multi-year, near-global campaign exploiting at least eight vulnerabilities and using legitimate RMM tools and Tor-based ShadowLink persistence to steal credentials, exfiltrate data, and maintain long-term access to critical sectors across the US, UK, Canada, Australia and beyond; some intrusions preceded destructive attacks, indicating potential for disruptive operations.