A Hacker Group Within Russia’s Notorious Sandworm Unit Is Breaching Western Networks

Microsoft attributes a persistent threat actor named "BadPilot" that performs broad, high-volume intrusion attempts then refines focus on selected victims. From 2022–2024 its targeting shifted from primarily Ukraine to worldwide and then to Western nations (US, UK, Canada, Australia); targeted sectors include energy, oil & gas, telecommunications, shipping, arms manufacturing and international governments. Microsoft also reports that some of BadPilot’s operations coincided with data-destroying cyberattacks carried out by Sandworm against Ukrainian targets.