Threathunt: Seashell Blizzard Group - Known Cheapshot activity
Microsoft Threat Intelligence observed Russian military Intelligence actor Seashell Blizzard conduct a phishing campaign using Excel attachments embedded with the custom CheapShot malware. CheapShot allows the actor to maintain persistence on targeted devices, likely to support intelligence collection. The actor primarily targeted critical infrastructure and key resources in Ukraine and Europe. Search for events in your network and locate potential CheapShot malware- related indicators. The file hashes are associated with CheapShot activity.
Microsoft Sentinel (KQL)
