Microsoft Warns of Sandworm's BadPilot Targeting Western Networks: Exploiting Vulnerabilities in Key Software for Initial Access

Microsoft identifies a Sandworm subgroup, BadPilot, targeting Western networks. * BadPilot focuses on initial network access before handing off to other Sandworm hackers. * Targets include US, UK, Canada, and Australia. * Exploits vulnerabilities in Microsoft Exchange, Outlook, OpenFire, JetBrains, and Zimbra. * Uses Connectwise ScreenConnect and Fortinet FortiClient EMS for Western targets. * Installs Atera Agent or Splashtop Remote Services for persistent access. * Turns victim computers into Tor onion services to hide communications. * Targets energy, oil, gas, telecommunications, shipping, arms manufacturing, and international governments.