Russia Exploits Cyber Backdoors to Target Ukraine with Malware

Microsoft has identified a Russian hacking group, Secret Blizzard, using sophisticated malware to target Starlink-connected devices in Ukraine. The group employed the Amadey malware to deploy a PowerShell dropper, which installed the Tavdig backdoor for reconnaissance on high-value targets, particularly those using Starlink IP addresses. Secret Blizzard has been observed using tools from other threat groups, including Storm-1837, to enhance their cyberattacks. This activity highlights ongoing cyber threats against Ukrainian military infrastructure.