Blizzard
- First seen
- 2022-03-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 15:39:03
Targeted industries: financial-services government-and-public-sector
Context
Blizzard is a ransomware with no affiliations to existing families, known for encrypting crucial files and demanding ransom payments to decrypt them. It emerged in early 2022, targeting mainly financial institutions and government sectors.
Used by threat actors
- APT29 TeamCity Exploits (campaign)
- BadPilot (campaign)
- HPE Midnight Blizzard Office 365 Email Exfiltration (campaign)
- Microsoft Midnight Blizzard Breach (campaign)
- Midnight Blizzard RDP File Spearphishing Campaign (campaign)
- Russian SVR Cyber Operations and Vulnerability Exploitation Activity (campaign)
- Unit 29155 Russian Military Cyber Activity (campaign)
Reports & references
- connect-trojan.net — Blizzard Rat Lite V1.3.1 (report)