Loading malware…
LocalOlive is an ASPX web shell that Microsoft has identified as exclusive to a Seashell Blizzard (Sandworm) initial-access subgroup linked to Russia’s GRU Unit 74455. It has reportedly been in use since at least late 2021 and has been described as a signature Sandworm-associated web shell. Its documented capabilities include command-and-control, command execution, file transfer or file upload, opening a TCP port, and facilitating delivery of next-stage payloads such as Chisel, plink, and rsockstun. Multiple sources in the content state it has been used to provide initial access on compromised perimeter infrastructure after exploitation of unpatched or publicly exposed internet-facing systems. Reported victim sectors and geographies tied to the broader subgroup activity include energy, oil and gas, telecommunications, shipping, arms manufacturing, government, and organizations in Ukraine, Europe, Central Asia, South Asia, the Middle East, and later the United States, United Kingdom, Canada, and Australia. In separate 2025 intrusions against Ukrainian organizations, investigators observed LocalOlive deployed on public-facing servers as part of Russian-linked activity focused on persistence and credential theft, although those investigators said they could not independently confirm Sandworm attribution. High-confidence network indicators mentioned in the content for related activity include hwupdates[.]com, cloud-sync[.]org, 103.201.129[.]130, 185.145.245[.]209, and ciscoheartbeat[.]com.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the webshells used was Localolive, which, according to Microsoft, is associated with a sub-group of the Russian Sandworm group (aka Seashell Blizzard) and has previously been used to provide initial access in a Sandworm campaign.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers gained access to the business services organization by deploying webshells on public-facing servers, most likely by exploiting one or more unpatched vulnerabilities.
The attackers gained access to the business services organization by deploying webshells on public-facing servers, most likely by exploiting one or more unpatched vulnerabilities. One of the webshells used was Localolive, which, according to Microsoft, is associated with a sub-group of the Russian Sandworm group (aka Seashell Blizzard).
After deploying web shells, the initial access subgroup then executes specific sequential commands below likely used to fingerprint and attribute victim networks...
After deploying web shells, the initial access subgroup then executes specific sequential commands below likely used to fingerprint and attribute victim networks...
After deploying web shells, the initial access subgroup then executes specific sequential commands below likely used to fingerprint and attribute victim networks...
Following exploitation, the subgroup used two methods of payload retrieval to install RMM agents on affected servers: Retrieval of Atera Agent installers from legitimate agent endpoints... via Bitsadmin and curl... [and] from actor-controlled virtual private server (VPS) infrastructure.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.