Microsoft details Cadet Blizzard, a GRU hacking group behind the WhisperGate data-wiping attacks in Ukraine carried out a month before Russia's 2022 invasion
BleepingComputerSergiu Gatlan
Context & Ripple Effects
This report moves the WhisperGate incident from an unattributed destructive event to a named GRU-linked cluster, making it part of a broader record of Russian state-linked activity against Ukraine. The closely related initial Cadet Blizzard attribution had already established that connection.
Later reporting tied Cadet Blizzard to GRU Unit 29155, while a separate Russia-backed group was reported to use criminal tools against Ukraine’s military to complicate attribution. Together, the coverage highlights both public attribution and operational concealment as parallel parts of the conflict.
First-order effects
Microsoft’s attribution gives Ukrainian defenders, incident responders, and government partners a specific actor label under which to organize analysis of WhisperGate activity.
Cadet Blizzard’s alleged role is more directly connected to Russian military intelligence, rather than being treated solely as an unidentified disruptive threat.
Second-order effects
Publicly associating the operation with a GRU-linked group increases the value of shared threat reporting around that cluster, while pushing state-backed operators to further separate tools and infrastructure from their identities.
The finding reinforces the challenge illustrated by Secret Blizzard’s use of cybercriminal tools: defenders must assess campaigns by behavior and targets, not only by apparent malware ownership.
Third-order effects
If such attributions continue to accumulate across campaigns, destructive cyberattacks are more likely to be analyzed as an integrated component of state conflict rather than isolated criminal incidents.
The pattern suggests a durable contest between increasingly detailed public attribution and adversaries’ efforts to preserve deniability; the balance will depend on the quality of cross-government and private-sector evidence.
The trend: This is one data point in the growing public mapping of state-linked cyber groups to military and geopolitical operations, even as those groups seek to obscure attribution.
Microsoft identifies a new GRU-affiliated hacking group dubbed “Cadet Blizzard”. During the runup to the Ukraine war, the group deployed destructive malware posing as simple ransomware. Cadet Blizzard primarily targets government and law enforcement. https://cyberscoop.com/...
We remain committed to tracking and reporting Russian cyberattacks targeting Ukraine and its allies. Today, we're sharing more on activity we've observed so that governments and our customers can protect themselves. https://blogs.microsoft.com/ ...
Since 2020, Russian threat actor Cadet Blizzard has carried out a series of cyberattacks aimed at Ukraine, NATO, Europe, and Latin America. Today, @Microsoft released new research on the group: https://twitter.com/...
Cadet Blizzard has demonstrated an ability to hold networks at risk of continued compromise for extended periods. Organizations can bolster security by focusing on areas of risk based on actor tradecraft enumerated in our report: https://aka.ms/...
Today, Microsoft Threat Intelligence shared new details about cyberattacks detected by a Russian-sponsored threat actor “Cadet Blizzard” who is targeting government and IT organizations in Ukraine, Europe, and Latin America. Please see details here https://www.microsoft.com/...
Two observations on the Cadet Blizzard Report. 1. It's nice to see procedures. 2. It's interesting ATT&CK Technique IDs aren't listed. Is this so people focus on the reported behaviors and not other random behaviors that are conflated into the IDs? https://www.microsoft.com/...