Microsoft Warns About BadPilot, a Unit of Russian State-Sponsored Group Sandworm

This entity has infiltrated critical organizations in about 50 countries, including Ukraine, the United States, and the United Kingdom.

On February 12, 2025, Microsoft’s cybersecurity teams published a report on BadPilot, a subunit of Sandworm, the Russian state-sponsored cybercriminal group. The researchers detail the attacks carried out by this recently identified unit against sensitive organizations across approximately 50 countries. Sandworm, also known as APT44 and Seashell Blizzard, operates under Russia’s military intelligence agency, the GRU.

BadPilot specializes in opportunistic attacks, exploiting known vulnerabilities in widely used enterprise software such as Microsoft Exchange, Outlook, ConnectWise, and Fortinet. These initial access points enable the group to steal credentials, execute malicious commands, and move laterally within compromised networks.

By ensuring persistent access to targeted IT systems, BadPilot paves the way for other Sandworm entities to conduct more specialized cyberattacks, including espionage operations and data theft.

Since 2021, BadPilot has targeted companies in the energy, oil and gas, telecommunications, and maritime transport sectors, as well as government organizations. Between 2021 and 2023, its attacks primarily focused on Ukraine, with secondary targets in Central Asia and the Middle East. Since 2024, the group has shifted its focus to the United States, Canada, the United Kingdom, and Australia.