Security researchers have uncovered a new threat group believed to be operating in relation to the Main Directorate of General Staff of the Russian Federation (GRU). The group is tracked as Cadet Blizzard and has already launched multiple campaigns since their foundation in January 2022, however additional technical traces show activity attributed to the group in 2020. Cadet Blizzard actors leverage techniques such as conducting disruption, destruction, information gathering, and exfiltration through any means necessary. Cadet Blizzard attacks their target by first breaching their infrastructure, establishing a foothold within the target’s network, and exfiltrating data prior to causing major disruptions to the target and their infrastructure. The group did undergo a brief hiatus in the middle of 2022 and has reemerged strong since the start of 2023. Since their rebirth in 2023, attribution has shown more signs pointing to the Russian Federation. Several key factors that show linkage to the organization include the posting by a forum user, Free Civilian, of exfiltrated data gathered by Cadet Blizzard threat actors. Historically, Free Civilian is known for their attribution to Russia and the explicit targeting of individuals associated with Ukraine. In addition to the forum posting, Free Civilian also created a Telegram channel containing stolen documents, also obtained by Cadet Blizzard, during the Russia-Ukraine conflict. Lastly, these threat actors utilize an arsenal of malicious tools and programs to deploy against their targets, most commonly used by WhisperGate. WhisperGate is a destructive program designed to cripple a target’s Master Boot Record (MBR) and corrupt system files beyond repair. Cadet Blizzard continues to show their strength in the first half of 2023 and is likely to continue their crusade well into the remainder of the year. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.