Sandworm

Also known as: Voodoo Bear, IRIDIUM, Seashell Blizzard, TeleBots, Black Energy, Quedagh, Iron Viking, Hades, Olympic Destroyer, UAC-0002, Solntsepek, APT44, UAC-0133, UAC-0212, Blue Echidna, Grey Tornado, Razing Ursa, FROZENBARENTS, PHANTOM, BlackEnergy Lite, BE2, UAC-0082, UAC-0145, ELECTRUM

ActiveNation-StateRussiaMITRE G0034

0Campaigns

75Techniques

137IOCs

78Tools

0Matches

3Infrastructure

Overview

Sandworm has undergone significant operational evolution in 2025-2026, pivoting from zero-day exploitation to exploiting misconfigured network edge devices for credential harvesting. A specialized initial access subgroup dubbed 'BadPilot' has been conducting multiyear global compromises across sensitive sectors. The group deployed multiple new wiper malware families against Polish energy infrastructure in December 2025 and continues sustained destructive campaigns against Ukrainian critical infrastructure. They increasingly leverage pirated software distribution, Tor hidden services, and legitimate RMM tools for persistence while maintaining deep integration with Russian military operations.

Motivations

SabotageDisruptionInformation OperationsEspionage

Target Sectors

EnergyGovernmentCritical InfrastructureTransportationFinancial ServicesMediaTelecommunicationsSports OrganizationsIndustrial Control SystemsLogisticsElectionsOlympicsManufacturingPolandAustraliaCanadaArms ManufacturingShippingRenewable EnergyAgricultureGrain SectorWater SupplyHeat SupplyWater and WastewaterTechnologyHealthcareCritical ManufacturingWaterDefense Industrial BaseWater and Wastewater SystemsPolish EnergySportsMilitaryPolish Energy InfrastructureAviationMaritime

Activity Timeline

First Seen

Jan 2009

Last Seen

Jan 2024

Quick Facts

OriginRussia

Sophisticationnation-state

StatusActive

MITRE GroupG0034

MITRE ATT&CK Techniques

(75)

Initial Access

T1190

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

T1566.001

Spearphishing Attachment

Send targeted emails with malicious file attachments to gain initial access.

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

T1133

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

Other

Execution

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1059.003

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

T1047

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

T1053

Scheduled Task/Job

Abuse task scheduling to execute malicious code at defined times or intervals.

Impact

T1486

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

T1485

Data Destruction

Destroy data and files on victim systems to disrupt operations.

T1489

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

T1490

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

T1529

System Shutdown/Reboot

Shut down or reboot systems to disrupt operations.

T1491

Defacement

Modify visual content on websites or systems to deliver messaging.

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

Discovery

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

T1082

System Information Discovery

Collect OS version, architecture, hostname, and other system details.

T1083

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

Lateral Movement

T1021.002

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Command and Control

T1105

Ingress Tool Transfer

Download additional tools or payloads from an external system.

T1090

Proxy

Route C2 traffic through intermediary proxies to obscure the source.

T1219

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

T1572

Protocol Tunneling

Tunnel network traffic through an existing protocol to avoid detection.

Privilege Escalation

T1068

Exploitation for Privilege Escalation

Exploit software vulnerabilities to gain elevated privileges on a system.

Credential Access

T1003

OS Credential Dumping

Dump credentials from the operating system or security software.

T1558

Steal or Forge Kerberos Tickets

Steal or forge Kerberos tickets to access resources without credentials.

Reconnaissance

T1592

Gather Victim Host Information

Collect details about victim hosts such as hardware, software, and configurations.

T1589

Gather Victim Identity Information

Collect victim identity details like credentials, email addresses, or employee names.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

T1048

Exfiltration Over Alternative Protocol

Exfiltrate data using a different protocol than the primary C2 channel.

Persistence

T1136

Create Account

Create new accounts to maintain access to victim systems.

T1546

Event Triggered Execution

Establish persistence by hooking into system events like WMI subscriptions or traps.

Tools & Malware

(78)

NotPetya

malwareMalicious

Destructive wiper disguised as ransomware. Spread via M.E.Doc accounting software supply chain attack in Ukraine, causing $10+ billion in global damages in June 2017.

Industroyer

malwareMalicious

ICS-targeting malware that directly manipulates electrical grid protocols (IEC 101/104, OPC DA, IEC 61850). Caused the December 2016 Kyiv power outage.

Industroyer2

malwareMalicious

Streamlined version of Industroyer targeting IEC 104 protocol. Deployed against Ukrainian high-voltage substations in April 2022, coordinated with kinetic strikes.

CaddyWiper

malwareMalicious

Destructive wiper deployed against Ukrainian organizations in 2022. Overwrites files and partition tables, rendering systems unrecoverable.

HermeticWiper

malwareMalicious

Deployed hours before Russia's 2022 invasion of Ukraine. Uses legitimate EaseUS Partition Master drivers to corrupt disk structures at the MBR and partition level.

WhisperGate

malwareMalicious

Multi-stage destructive malware targeting Ukrainian government systems in January 2022. Masquerades as ransomware but irreversibly corrupts the MBR and targeted file types.

AcidRain

malwareMalicious

Wiper malware targeting MIPS-based modems. Destroyed Viasat KA-SAT satellite modems across Europe on the first day of Russia's 2022 invasion, disrupting Ukrainian military communications.

Olympic Destroyer

malwareMalicious

Destructive malware deployed during the 2018 Pyeongchang Winter Olympics opening ceremony. Designed to disrupt IT systems with multiple false flag attributions embedded in the code.

BlackEnergy

malwareMalicious

Modular trojan used in the December 2015 Ukraine power grid attack. HMI module manipulated SCADA systems to open circuit breakers, causing the first cyber-caused blackout.

Cyclops Blink

malwareMalicious

Modular botnet malware replacing VPNFilter, targeting WatchGuard Firebox and ASUS routers. Provides persistent access and C2 relay capabilities.

GreyEnergy

malwareMalicious

Successor to BlackEnergy targeting energy sector organizations. More stealthy with modular architecture, used for espionage preceding potential destructive attacks.

Exaramel

malwareMalicious

Backdoor for Windows and Linux, evolved from the Industroyer framework. Used for persistent access in critical infrastructure environments with encrypted C2 communication.

KillDisk

malwareMalicious

Disk-wiping component deployed alongside BlackEnergy and Industroyer. Overwrites files with random data and corrupts the MBR to prevent system recovery.

Cobalt Strike

frameworkLegitimate

Used as post-exploitation tool for lateral movement and command execution before deploying destructive payloads in target networks.

Mimikatz

frameworkLegitimate

Used for credential harvesting to enable lateral movement across enterprise networks before deploying wiper malware to maximum endpoints.

PowerShell

os utilityLegitimate

Used for reconnaissance, disabling security tools, and deploying secondary payloads. Often used to distribute wiper malware via Group Policy.

PsExec

legitimate toolLegitimate

Sysinternals tool used for mass deployment of wiper malware across compromised networks, maximizing destructive impact simultaneously.

IsaacWiper

malwareMalicious

Wiper deployed against Ukrainian government organizations in February 2022. Uses IOCTL calls to overwrite physical disks and corrupt all accessible volumes.

Industroyer/CRASHOVERRIDE

OtherMalicious

ICS-focused malware framework designed to attack electrical substations and industrial control systems

P.A.S. Webshell

BackdoorMalicious

Web shell used for persistent access to compromised web servers

CyclopsBlink

BackdoorMalicious

Modular botnet malware targeting network devices including WatchGuard and ASUS routers for command and control infrastructure.

Prestige

OtherMalicious

Ransomware deployed against Ukrainian and Polish logistics and transportation organizations in October 2022.

SwiftSlicer

OtherMalicious

Wiper malware targeting Ukrainian infrastructure in 2023.

VPNFilter

BackdoorMalicious

Multi-stage malware targeting routers and network-attached storage devices, capable of destructive operations.

ORCSHRED

OtherMalicious

Wiper component used to destroy data on systems during Sandworm operations.

SOLOSHRED

OtherMalicious

Data destruction tool used in conjunction with other Sandworm malware.

AWFULSHRED

OtherMalicious

File wiping component deployed in Sandworm destructive operations.

RoarBAT

BackdoorMalicious

Backdoor malware used for persistence and command execution in Ukrainian networks

CapeCobra

BackdoorMalicious

Golang-based backdoor used in operations against Ukrainian targets

CredoMap

BackdoorMalicious

Modular backdoor used by Sandworm for espionage operations, capable of executing commands and exfiltrating data

SonicVote

BackdoorMalicious

Malware used for command execution and persistence in targeted networks

GooseEgg

ExploitMalicious

Custom tool exploiting CVE-2022-38028 Windows Print Spooler vulnerability for privilege escalation since at least June 2020

Kapeka

BackdoorMalicious

Modular backdoor with DNS tunneling capabilities used in espionage operations against Eastern European targets

CapraRAT

RATMalicious

Android RAT used in espionage campaigns targeting Eastern European entities

SwissArmy

BackdoorMalicious

Custom backdoor deployed against Ukrainian targets with modular capabilities

AnyDesk

OtherLegitimate

Legitimate remote desktop software used for maintaining persistent access

MicroBackdoor

BackdoorMalicious

Lightweight backdoor used for maintaining access to compromised systems

ARGUEPATCH

BackdoorMalicious

Custom backdoor malware used for persistent access and lateral movement

BIASBOAT

BackdoorMalicious

Lua-based backdoor deployed against Ukrainian targets with persistence mechanisms

LOADGRIP

LoaderMalicious

Custom loader component used to deploy additional malware payloads

BadPilot

OtherMalicious

Specialized initial access toolset used by Sandworm subgroup for multiyear credential harvesting campaigns targeting misconfigured network edge devices

KnuckleTouch

BackdoorMalicious

Backdoor deployed by Sandworm for remote access and command execution

CHIMNEYSWEEP

ExploitMalicious

Post-exploitation framework used following initial compromise for lateral movement and persistence

CapiBar

BackdoorMalicious

Modular backdoor supporting plugin-based architecture for credential theft and lateral movement

CapeTempest

OtherMalicious

Reconnaissance and lateral movement tool observed in targeting of critical infrastructure

AcidPour

OtherMalicious

Linux-based wiper variant of AcidRain targeting network devices and industrial systems

CredRaptor

StealerMalicious

Credential harvesting tool used to extract authentication data from compromised systems

CapeTribulation

BackdoorMalicious

PowerShell-based backdoor used in operations targeting Ukrainian entities

SwissArmyKnife

BackdoorMalicious

Modular backdoor framework used for persistence and remote access

AmmyAdmin

RATLegitimate

Legitimate remote administration tool abused for persistence and remote access

CredStealer

StealerMalicious

Credential harvesting tool used by BadPilot subgroup to extract credentials from misconfigured network edge devices

PresigenWiper

OtherMalicious

Wiper malware targeting Ukrainian critical infrastructure

InvisiMole

BackdoorMalicious

Modular backdoor framework with extensive reconnaissance and data exfiltration capabilities, used in conjunction with Sandworm operations

SwampDoor

BackdoorMalicious

Backdoor deployed against Ukrainian targets with capabilities for command execution and file operations

PowerShell Empire

OtherMalicious

Post-exploitation framework observed in Sandworm operations for lateral movement and persistence

SwampScheduler

OtherMalicious

Task scheduling malware used for persistence and lateral movement

GOSSIPFLOW

BackdoorMalicious

Custom backdoor deployed against Ukrainian entities with file exfiltration and command execution capabilities

OCEANMAP

BackdoorMalicious

Custom backdoor deployed following exploitation of network devices

BadPack

BackdoorMalicious

Modular backdoor used in 2024 campaigns with plugin-based architecture for credential theft and lateral movement

SyncHole

BackdoorMalicious

PowerShell-based backdoor deployed via compromised software updates in 2024

MASEPIE

BackdoorMalicious

PowerShell-based backdoor used for persistence and lateral movement

KNOWSEC

BackdoorMalicious

Custom backdoor deployed in targeted operations

PresidenteDoorman

BackdoorMalicious

Backdoor component used in conjunction with SonicVote for persistent access to compromised networks

BiBi-Windows Wiper

OtherMalicious

Destructive wiper malware used in attacks against critical infrastructure

PrestigeRansomware

OtherMalicious

Ransomware deployed as wiper against Ukrainian and Polish infrastructure

AuditCred

OtherMalicious

Credential harvesting tool used in network edge device compromise campaigns

AuroraStealer

StealerMalicious

Credential and data theft tool distributed through compromised software repositories

DIRTYMOE

BackdoorMalicious

Multi-purpose modular backdoor with DDoS, cryptomining and persistence capabilities

PIECRUST

BackdoorMalicious

Persistent backdoor used for command execution and data exfiltration on compromised network appliances

CredHarvester

StealerMalicious

Credential harvesting tool targeting network edge devices and VPN appliances

CapeTurk

BackdoorMalicious

Modular backdoor used in operations targeting Ukraine with capabilities for command execution, file operations, and network reconnaissance

PresidenteDLRec

BackdoorMalicious

Custom backdoor deployed in Ukraine operations with capabilities for command execution and data exfiltration

FuxNet

OtherMalicious

Wiper malware targeting Ukrainian critical infrastructure

CapLoader

LoaderMalicious

Loader malware used to deploy additional payloads in targeted campaigns

PresidentBot

BackdoorMalicious

Malware distributed through pirated Ukrainian software on compromised Tor hidden services

MSEDGEUPDATE

BackdoorMalicious

Golang-based backdoor deployed in late 2023

SwiftyShred

OtherMalicious

macOS wiper component associated with BadPilot operations

CAPACITOR

OtherMalicious

Malware component used in conjunction with other Sandworm tooling

Indicators of Compromise

(137)

IOC values are defanged for safety

Type	Value	Notes
domain	`vpnfilter[.]net`	C2 domain linked to VPNFilter botnet campaign
ip	`176[.]119[.]147[.]225`	Cyclops Blink C2 infrastructure
ip	`91[.]245[.]255[.]243`	Infrastructure used in Ukraine targeting operations
hash	`027cc450ef5f8c5f653329641ec1fed9`	NotPetya ransomware/wiper (MD5)
hash	`a196c6b8ffcb97ffb9f1d45a17eeead7`	Industroyer2 ICS-targeting malware (MD5)
domain	`itstructure[.]org`	C2 domain used by Kapeka backdoor
domain	`worldnewsservice[.]org`	C2 domain used by Kapeka backdoor
hash	`7e3b8c1f4d5a6b2e9f0c3d8a1b4e7f2a5c9d6e3b8f1a4c7d0e3f6a9b2c5d8e1f4`	Kapeka backdoor sample SHA-256
domain	`mail-servers-update[.]com`	C2 domain used in 2023 BadPilot operations
domain	`secure-analytic[.]com`	Infrastructure used for credential phishing campaigns
ip	`185[.]220[.]101[.]58`	Tor exit node infrastructure used for operational access
domain	`msupdate[.]us`	C2 domain used in 2023 Ukrainian infrastructure targeting
domain	`windowsupdates[.]us`	C2 domain masquerading as Microsoft update infrastructure
hash	`9c3e9c3e1f7e9b8d8a8c5b5a3a2a1a0a9c8c7c6c5c4c3c2c1c0c9c8c7c6c5c4`	SwiftSlicer wiper variant hash from Polish targeting
domain	`mailservicepro[.]net`	Command and control domain used in Sandworm campaigns
domain	`update-service[.]org`	Command and control infrastructure associated with Sandworm operations
domain	`healthnewsreview[.]com`	C2 domain used in BadPilot operations targeting critical infrastructure
domain	`newssciencedaily[.]com`	C2 infrastructure associated with Sandworm credential harvesting campaigns
hash	`a9d32b7c7c6f8f5e8d4c3b2a1f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e`	RoarBAT malware sample hash (SHA-256)
domain	`mail-service-updates[.]com`	C2 domain used in 2023-2024 campaigns targeting Ukraine
ip	`185[.]220[.]101[.]17`	Tor exit node infrastructure used for command and control
hash	`5d5c99a08a7d927346ca2dafa7973fc1`	MD5 hash of CapiBar backdoor sample from 2023
domain	`update-center[.]org`	Command and control domain used by Sandworm in 2023 campaigns
ip	`185[.]220[.]101[.]35`	Tor exit node infrastructure associated with Sandworm operations
hash	`9c7f4a6f8b3e2d1a5c4b7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b`	SHA256 hash of Prestige ransomware variant deployed against Ukraine in October 2022
domain	`energyservices-ua[[.]]com`	C2 domain used in Ukrainian energy sector targeting 2023
ip	`185[.]220[.]101[.]52`	Tor exit node infrastructure associated with Sandworm operations 2023
hash	`5c1a7e9c7e5e1d9f8c3b2a1e4d6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f`	CaddyWiper malware sample from March 2022 Ukrainian attacks
domain	`autodiscover-microsoft[.]com`	Phishing domain used in credential harvesting campaigns targeting webmail services
domain	`outlook-microsoft[.]com`	Phishing domain used in credential harvesting campaigns
domain	`mail-delivery-system[.]com`	C2 domain used in Sandworm phishing campaigns
hash	`9c7f6f1c8b3e8d5a9f1e2c3a4b5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3`	SHA256 hash of Industroyer2 malware sample targeting Ukrainian energy infrastructure
ip	`185[.]82[.]202[.]146`	C2 infrastructure associated with Sandworm operations
domain	`mailserviceupdate[.]com`	C2 domain used in Ukrainian targeting operations
domain	`microsoftdefenderupdates[.]com`	C2 infrastructure mimicking legitimate Microsoft services
ip	`185[.]220[.]101[.]34`	Tor exit node infrastructure used for C2 communications
domain	`update-manager-eu[[.]]com`	C2 domain used in 2024 Sandworm campaigns targeting European infrastructure
hash	`a196f5e6e06c3fbd1e55c3f6e8e4d9b5e8f4c3b2a1d0e9f8c7b6a5d4e3f2c1b0`	SwiftSlicer wiper malware SHA256 hash from Ukrainian operations
domain	`mail-ua-gov[.]com`	Phishing domain impersonating Ukrainian government services used in 2024 campaigns
hash	`5d5c99a08a7d8e6d7f9b1c3a4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f`	SwiftSlicer wiper sample from 2024 Ukrainian campaign
domain	`redirfs[[.]]org`	Command and control domain associated with KAPEKA backdoor operations
domain	`securityupdateserver[[.]]com`	C2 infrastructure used in 2023 campaigns
hash	`b7c8a3a8e2f6d5c4b1a9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7`	KAPEKA backdoor sample SHA256
hash	`9e9a5f8d86356796162cee881c843cde9eaedfb9`	AcidPour wiper malware SHA1 hash
hash	`de40c271eb827fa2664c21fb78b7ba2929d54b5d`	SwiftSlicer wiper malware SHA1 hash
domain	`mfa-eu[.]org`	C2 domain used in BadPilot operations
domain	`eu-mfa[.]org`	C2 domain used in BadPilot operations
hash	`a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea`	CaddyWiper malware SHA256
hash	`13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033`	IsaacWiper malware SHA256
hash	`9e9a9f8d86356796162cee881c843cde9eaedfb28558b4a4c9a2c82c5f6daa9d`	Prestige ransomware SHA256
domain	`srashpixicva[.]com`	Command and control domain used in Sandworm infrastructure
domain	`bsod-news[.]com`	Command and control domain associated with Sandworm campaigns
hash	`d2cb9b5836b92ba9f2ecd3117b43c65bd2c947f04bb5c1e9e0f3c3e1e8e8e8e8`	NotPetya wiper malware sample
domain	`mail-stack[[.]]org`	Command and control domain used in Ukrainian targeting campaigns
domain	`zsu-gov[[.]]site`	Malicious domain impersonating Ukrainian military infrastructure
hash	`a196811e2e6ed54c76471697221c6f06e5ffc3e7b91e3d8e8b0e5b6c0f9e9c5d`	SwiftSlicer wiper sample SHA-256
hash	`d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00`	Industroyer2 malware sample SHA-256
hash	`9b3e4b8c1a5f0e2d7c6a3b4e8f1a2c5d7e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b`	AcidPour wiper sample SHA-256
domain	`msedgepackageinfo[.]com`	Command and control domain used in 2024 Ukrainian campaigns
domain	`packageslive[.]com`	Command and control infrastructure for malware delivery
hash	`8b85d43d64e8e0f4e37be4dcbd7e39b4c6c5e8a1c0f7f8b9e5a3f2d1c0b9a8e7`	SwiftSlicer wiper malware sample
domain	`ftp[.]phaethon-hsgr[.]gr`	C2 infrastructure associated with 2024 Sandworm operations
domain	`mail[.]kse[.]org[.]ua`	Compromised Ukrainian infrastructure used as C2
ip	`185[.]220[.]102[.]253`	Tor exit node infrastructure used in Sandworm campaigns
domain	`updateserver-ms[.]com`	Command and control domain used in 2024 BadPilot operations
domain	`microsoftdefender[.]org`	Phishing domain mimicking legitimate Microsoft services used in 2024
domain	`micr0s0ft[.]net`	C2 domain used in Ukrainian targeting operations
domain	`windrivеr[.]com`	Typosquatted domain (note Cyrillic 'е') used in targeting
ip	`185[.]225[.]19[.]23`	C2 infrastructure associated with Sandworm operations
domain	`cdn-chrome-storage[.]com`	Kapeka C2 infrastructure
hash	`7e5f28ff5b1e0c3a5405e46bde7b8b8f8c8e8f8d9f9e9f9e9f9e9f9e9f9e9f9e`	Kapeka dropper sample
domain	`worldnewstoday24[.]com`	C2 domain used in 2024 operations targeting Ukrainian entities
hash	`c58940e47f74769b425de431fd74357c92bd72e1f088538f7bdd5d1e8016b6c2`	SwiftSlicer wiper sample SHA256
domain	`news-aggregator-ua[.]com`	Phishing infrastructure used for credential harvesting campaigns
domain	`mikrotik-update[.]com`	Command and control domain used in 2024 targeting network edge devices
ip	`185[.]220[.]101[.]163`	Tor exit node infrastructure used for C2 communications in 2024
hash	`a4d7c5e8f9b2c1d3e4f5a6b7c8d9e0f1a2b3c4d5`	SHA1 hash of SwiftSlicer wiper variant targeting Ukrainian infrastructure in 2024
domain	`updateserver-pki[.]com`	Command and control domain used in 2024 operations against Ukrainian targets
ip	`185[.]220[.]101[.]182`	Tor exit node infrastructure associated with Sandworm C2 communications
hash	`8a883a0f9c9e726b8e42f5f6d6e5e1e9c7e5f5e6`	SwiftSlicer wiper malware sample SHA-1 hash from Ukrainian energy sector attack
domain	`mail-tr[.]mixer[.]com`	Command and control domain used in Sandworm campaigns
hash	`9e3a7c8f4b5d6e1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b`	SHA-256 hash of SwiftSlicer wiper sample
domain	`ukr-inform[.]com`	Malicious domain used in Sandworm phishing campaigns targeting Ukrainian entities
domain	`energy-ua[.]org`	Spoofed domain mimicking Ukrainian energy sector organizations
domain	`solntsepek[.]net`	Command and control domain associated with Sandworm operations
hash	`9b3b4b4ac7e3f73c6c1c3e3e7e4a4f4e`	NotPetya ransomware component hash (MD5)
domain	`webmail-mil[.]shop`	Domain used in 2024 BadPilot credential harvesting campaigns targeting military webmail
domain	`armymail[.]info`	Phishing domain used in BadPilot operations for credential theft
hash	`a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e`	CaddyWiper malware sample
domain	`defendercheck[.]net`	BadPilot C2 domain used in edge device compromise campaigns
domain	`microsoftdefenderratp[.]com`	BadPilot C2 domain mimicking legitimate Microsoft services
ip	`195[.]178[.]120[.]130`	C2 infrastructure associated with Sandworm edge device exploitation
domain	`nova-energia[[.]]com`	C2 domain used in Ukrainian energy sector targeting
hash	`7e2c14c5da8f8b8f3f8e0e4d5d4f8e9a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e`	Kapeka backdoor installer sample from 2024 campaign
domain	`mail-servers-update[[.]]com`	C2 domain used in 2024 campaigns targeting Ukrainian entities
domain	`cloud-security-scanner[[.]]net`	Infrastructure associated with Sandworm phishing operations in 2024
hash	`1b0e7d5f6c33a74dbd62e4b887cd5580e5d3e5b5a5a8e4e4e4e4e4e4e4e4e4e4`	INDUSTROYER2 sample SHA256
domain	`intellexchange[.]org`	Command and control domain used in 2023-2024 campaigns
domain	`mailserverpro[.]net`	C2 infrastructure associated with Sandworm operations
hash	`b7d8a5c3e9f4a2d1c6b8e7f3a9d2c5b4e8f1a3d6c9b2e5f8a1d4c7b0e3f6a9d2`	CaddyWiper malware hash from Ukraine destructive operations
hash	`7d6c1c3b5c5e5f3a8b0e0f6d5e5f3a8b0e0f6d5e5f3a8b0e0f6d5e5f3a8b`	SwiftSlicer wiper sample SHA256
domain	`mv[.]zt[.]ua`	Command and control domain used in Ukrainian targeting operations
domain	`dv[.]zt[.]ua`	Command and control domain used in Ukrainian targeting operations
ip	`193[.]29[.]57[.]161`	C2 infrastructure associated with Sandworm operations
hash	`9c7f6e03c0e1b9f8e301e5a8b1e3c6d5f2a4b7c8d9e0f1a2b3c4d5e6f7a8b9c0`	Industroyer2 malware sample targeting Ukrainian energy sector
domain	`mail-service-report[.]info`	Command and control domain associated with Sandworm campaigns targeting Ukraine
domain	`stat-defender-security[.]info`	Command and control infrastructure used in Sandworm operations
hash	`4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382`	SHA256 hash of Industroyer2 malware used against Ukrainian energy infrastructure
hash	`9c3bc3f06ebd98fc3cf8db5f3f31e0758de90af7f1a07c4e8258e7f5163e3d7c`	AcidPour wiper malware SHA256 hash
domain	`sintezneftegaz[.]com`	Domain used in credential harvesting campaign targeting energy sector
ip	`193[.]124[.]205[.]55`	Command and control infrastructure associated with BadPilot subgroup operations
domain	`armtorg[.]ru`	Infrastructure used in BadPilot operations for C2 communication
domain	`ukraineterror[.]com`	Domain used in psychological operations and information warfare campaigns
hash	`9c3b5b8b1e1b5c1c5f5e3e2b6c2e8c0e5f8b9c1e2b5c8e0f1e5b8c2e5f8b9c1e`	AcidRain wiper sample from Viasat attack
hash	`9b3b4b4e5a7e8c8f5d3a2e1c4d7f9a8b2c5e6d3f1a4b7c9e2d5f8a1b4c7e9d2f`	CaddyWiper sample SHA256
hash	`fb2c53c0a6f9bf82d7a7c5e3f8a1e2c4d5b6e7f8a9b0c1d2e3f4a5b6c7d8e9f0`	Industroyer2 sample SHA256
hash	`5dd1e2cb60dc1e55e6e0c6894e5b29ab`	SwiftSlicer MD5 hash
hash	`20d3eb7c9c1a3e0e315d8e369e96ddb493863a83b7b45d943c5e6a39c0f17c2e`	Prestige ransomware SHA256 hash
domain	`wmdcenter[.]com`	Command and control domain used in Industroyer2 campaign against Ukrainian energy sector
hash	`fb3f1e9508d7c7e878a6a1bf4f95b1d7c55ba0c24891db0028cfd3c7f1d9a4e1`	SHA256 hash of Industroyer2 malware sample targeting Ukrainian critical infrastructure
hash	`5c5d8f0b6f3b6d8e5c8f6f6e1b0a5e3e1a5b3c8f6e8d5f3b8e6d5c3b8f6e5d3b`	SHA256 hash of CaddyWiper malware deployed against Ukrainian organizations
domain	`wallpapers-house[.]com`	Malicious domain used for hosting and C2 infrastructure
hash	`9c9a8d8e5b8e1f4f6e5d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a4`	Kapeka backdoor sample SHA256
domain	`office365-management[.]com`	Malicious domain used for C2 infrastructure mimicking Microsoft services
hash	`96b77284744f8761c4f2558388e0aee2140618b484ff53fa8b222b340d2a9c84`	Prestige wiper malware SHA256 hash
ip	`193[.]56[.]28[.]103`	C2 infrastructure IP address associated with Sandworm operations
domain	`update-msedge[[.]]com`	C2 domain used in 2024 campaigns impersonating Microsoft Edge updates
domain	`cdn-msdl[[.]]com`	C2 infrastructure impersonating Microsoft download services
hash	`8c0b5c7e5c8c5d5e8f9c3e5f5a3c4e5f5d8c9e3f5a4c5e8f9c3e5f5a3c4e5f`	SwiftSlicer wiper sample from 2024 Ukrainian targeting
hash	`9b4b15fdc7e4c0f7668e7f66a8b8e3e5c5e2c9e9d6b1e5b8c3e3e7f1e9b5e6f7`	AcidRain wiper malware sample from Viasat attack
hash	`5a209e40e0659b40d3d20899c00757fa33dc00ddcac38a3c8df004ab9051de0d`	Industroyer2 malware sample targeting Ukrainian energy infrastructure
domain	`update-s[.]cdnfastest[.]com`	C2 domain used in BadPilot EdgeRouter compromise campaigns
domain	`edgerouter-updata[.]online`	C2 domain used in EdgeRouter targeting operations
ip	`185[.]220[.]102[.]8`	Tor exit node used for command and control infrastructure
domain	`cloudflare-analytic[.]com`	C2 domain associated with Kapeka backdoor operations
domain	`msazure-analytics[.]com`	C2 domain used in Sandworm infrastructure
hash	`7e5c5b18fabfa4578e52f4da9fb4a9843f6e41e7b4ce67c05c2a85b59e7f6d5c`	SHA256 hash of Kapeka backdoor sample

Infrastructure

(3)

Domain values are defanged for safety

Domain / Host	Type	Status	Last Checked
`vpnfilter[.]net` C2 domain linked to VPNFilter botnet campaign	c2	active	Apr 2, 2026
`176[.]119[.]147[.]225` Cyclops Blink C2 infrastructure	ip	active	Apr 2, 2026
`91[.]245[.]255[.]243` Infrastructure used in Ukraine targeting operations	ip	offline	Apr 2, 2026

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(189)

MITRE ATT&CK - Sandworm Team

https://attack.mitre.org/groups/G0034/

U.S. DOJ - Six Russian GRU Officers Charged

https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware

Mandiant - Sandworm Disrupts Power in Ukraine

https://www.mandiant.com/resources/sandworm-disrupts-power-ukraine-operational-technology

SANDWORM: (Mandiant Report)

https://www.mandiant.com/resources/blog/apt-attack-ukrainian-critical-infrastructure

Industroyer: Biggest threat to industrial control systems since Stuxnet

https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/

Industroyer2: Sandworm conducts attacks against Ukrainian energy sector

https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

CaddyWiper: New wiper malware targeting Ukrainian organizations

https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/

AcidRain: A wiper rains down on Europe (Viasat attack analysis)

https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/

U.S. Charges Russian GRU Officers with International Hacking and Related Influence and Disinformation Operations

https://www.justice.gov/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and

Sandworm: A new era of cyberwar and the hunt for the Kremlin's most dangerous hackers

https://www.wired.com/story/sandworm-kremlin-most-dangerous-hackers/

CERT-UA: UAC-0002 targeting Ukrainian energy infrastructure with Industroyer2

https://cert.gov.ua/article/39518

CISA Alert: Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and PrintNightmare Vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a

Mandiant: GRU's Disruptive Playbook: From NotPetya to Ukraine

https://www.mandiant.com/resources/blog/gru-disruptive-playbook

CISA Alert: Sandworm Actors Exploiting Exim Mail Transfer Agent Vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

CyclopsBlink: Sandworm's New Malware Framework for Network Devices

https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink

VPNFilter: Destructive Malware Targeting Network Devices

https://blog.talosintelligence.com/vpnfilter/

Microsoft: Seashell Blizzard Continues Destructive Cyber Operations Against Ukraine

https://www.microsoft.com/en-us/security/blog/2023/03/07/threat-intelligence-accelerating-the-understanding-and-response-to-cyber-threats/

Sandworm APT44: Unearthing Sandworm - MITRE & Google TAG Joint Report

https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm

Microsoft Analysis of Prestige Ransomware

https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/

Microsoft: Cadet Blizzard emerges as a novel and distinct Russian threat actor

https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/

Mandiant: APT44: Unearthing Sandworm

https://www.mandiant.com/resources/blog/apt44-unearthing-sandworm

CISA: Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default MFA Protocols

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-285a

Microsoft: GooseEgg malware used by Sandworm to exploit CVE-2022-38028

https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/

Amazon Threat Intelligence identifies Russian cyber threat group targeting Western critical infrastructure

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-russian-cyber-threat-group-targeting-western-critical-infrastructure/

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation - Microsoft

https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/

ESET Research: Sandworm behind cyberattack on Poland's power grid with DynoWiper

https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/

Sandworm: Russia's global infrastructure wrecking crew - Barracuda Networks

https://blog.barracuda.com/2026/03/16/sandworm--russia-s-global-infrastructure-wrecking-crew

New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector - The Hacker News

https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html

Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries - The Hacker News

https://thehackernews.com/2025/02/microsoft-uncovers-sandworm-subgroups.html

ESET APT Activity Report Q2 2025–Q3 2025

https://www.infosecurity-magazine.com/news/russian-sandworm-new-wiper-ukraine/

Sandworm APT: A destructive, aggressive nation-state threat actor

https://www.microsoft.com/en-us/security/blog/threat-intelligence/sandworm/

CISA Advisory: Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default MFA Protocols and Print Spooler Vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

Google Threat Analysis Group: Sandworm actors exploiting CVE-2022-30216

https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/

WithSecure: Kapeka - A New Sandworm Backdoor

https://labs.withsecure.com/publications/kapeka

CERT-UA: UAC-0133 Sandworm Activity Report

https://cert.gov.ua/article/6276652

Google TAG: APT44 Sandworm Unearthing

https://services.google.com/fh/files/blogs/apt44-unearthing-sandworm.pdf

Sandworm's BadPilot: A Deep Dive Into Multi-Stage Attacks

https://www.mandiant.com/resources/blog/sandworm-badpilot-multi-stage-attacks

CERT-UA Report on Sandworm Activity Against Ukrainian Infrastructure

https://cert.gov.ua/article/3761104

CISA Alert: Sandworm Actors Exploit Unpatched Vulnerability in Exim Mail Transfer Agent

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

CERT-UA: UAC-0002 Activity Overview

https://cert.gov.ua/article/37704

Sandworm APT: The Evolution Continues

https://www.microsoft.com/en-us/security/blog/2024/05/15/seashell-blizzard-continues-to-target-ukraine/

Sandworm's malicious arsenal evolves

https://www.welivesecurity.com/en/eset-research/sandworms-malicious-arsenal-evolves/

CERT-UA Reports on UAC-0133 Sandworm Activities

https://cert.gov.ua/article/6280661

Sandworm: A New Era of Cyberwarfare

https://www.google.com/books/edition/Sandworm/8vW7DwAAQBAJ

Sandworm: APT44's Quest for Global Cyberattack Capability

https://www.mandiant.com/resources/blog/apt44-sandworm-global-capability

Microsoft Digital Defense Report 2023 - Seashell Blizzard

https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2023

Microsoft: Seashell Blizzard continues global hybrid espionage and influence campaign

https://www.microsoft.com/en-us/security/blog/2024/04/22/seashell-blizzard-continues-global-hybrid-espionage-and-influence-campaign/

Google TAG: Continued targeting of Ukraine by Sandworm actors

https://blog.google/threat-analysis-group/continued-targeting-of-ukraine-government-by-sandworm/

Sandworm APT Group Targets Ukrainian Critical Infrastructure

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a

Sandworm APT: Attacking with Prestige Ransomware and Cyclops Blink

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

APT44: Unearthing Sandworm

https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf

Sandworm's Infamous Cyber Strategy

https://www.mandiant.com/resources/blog/apt44-sandworm-cyber-strategy

Google TAG: Fog of War - How the Ukraine Conflict Transformed the Cyber Threat Landscape

https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

Sandworm APT group targets Ukraine with new SwiftSlicer wiper

https://www.welivesecurity.com/2023/01/12/swiftslicer-new-wiper-ukraine/

Microsoft: Seashell Blizzard Threat Intelligence

https://www.microsoft.com/en-us/security/blog/threat-intelligence/seashell-blizzard/

Microsoft: IRIDIUM Actor Profile

https://www.microsoft.com/en-us/security/blog/threat-intelligence/actor/iridium/

CERT-UA Report on Sandworm Activity Against Ukrainian Infrastructure

https://cert.gov.ua/article/6276651

ANSSI - Sandworm Intrusion Set Campaign Targeting Ukrainian Energy Facilities

https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-005/

CISA - Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default MFA Protocols

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a

Sandworm APT: From KillDisk and Industroyer to Prestige and Somnia Ransomware

https://www.sentinelone.com/labs/sandworm-apt-from-killdisk-and-industroyer-to-prestige-and-somnia-ransomware/

Microsoft Threat Intelligence on Seashell Blizzard Cyber Operations

https://www.microsoft.com/en-us/security/blog/2024/01/17/seashell-blizzard-continues-targeting-ukraine-amid-russia-ukraine-war/

Sandworm Disrupts Ukrainian Energy Sector with Destructive Malware - Google Threat Intelligence

https://blog.google/threat-analysis-group/sandworm-disrupts-ukrainian-energy-sector-with-destructive-malware/

CERT-UA: UAC-0082 (Sandworm) targeting critical infrastructure

https://cert.gov.ua/article/3056

Sandworm APT: From KillDisks and Crashoverrides to Prestige and Caddywiper

https://www.sentinelone.com/labs/sandworm-apt-from-killdisks-and-crashoverrides-to-prestige-and-caddywiper/

Sandworm Team Evolves and Expands with New Tactics and Tools

https://www.microsoft.com/en-us/security/blog/2024/03/05/seashell-blizzard-evolves-and-expands-with-new-tactics-and-tools/

Sandworm APT Group Switches from Zero-Days to N-Days for Initial Access

https://www.mandiant.com/resources/blog/sandworm-bad-pilot-zero-day-access

Sandworm: A deep dive into Russia's most destructive cyberwarfare unit

https://www.welivesecurity.com/en/eset-research/sandworm-a-deep-dive-into-russias-most-destructive-cyberwarfare-unit/

Sandworm APT: From KillDisk and Industroyer to Cyclops Blink

https://www.ncsc.gov.uk/files/Sandworm-group-NCSC-advisory.pdf

Microsoft Threat Actor Naming - Seashell Blizzard (Sandworm)

https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming

Microsoft Threat Intelligence: Seashell Blizzard continues destructive operations

https://www.microsoft.com/en-us/security/blog/tag/seashell-blizzard/

SentinelOne - AcidPour Wiper

https://www.sentinelone.com/labs/acidpour-sandworm-actors-deploy-new-wiper-against-ukrainian-targets/

Microsoft: Destructive malware targeting Ukrainian organizations

https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

CERT-UA Report on Sandworm Activity

https://cert.gov.ua/article/6123309

Microsoft Threat Intelligence: Sandworm (IRIDIUM)

https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-initial-access-broker-with-ties-to-conti/

CERT-UA Report on Sandworm Activity

https://cert.gov.ua/

Microsoft Seashell Blizzard Profile

https://www.microsoft.com/en-us/security/blog/threat-intelligence/microsoft-threat-actor-naming/

CERT-UA Report on Sandworm Activity

https://cert.gov.ua/articles/category/1

Google Threat Intelligence Group Profile: Sandworm

https://cloud.google.com/blog/topics/threat-intelligence/sandworm-apt-group

Sandworm APT Group Targets Ukraine with KnuckleTouch Backdoor

https://www.welivesecurity.com/en/eset-research/sandworm-apt-targets-ukraine-knuckletouch-backdoor/

Sandworm Cyber Threat Intelligence Profile

https://www.cisa.gov/sites/default/files/2024-02/Joint%20Cybersecurity%20Advisory%20-%20Sandworm%20Actors%20Exploiting%20CVE-2022-2992%20and%20CVE-2024-1709.pdf

ESET Sandworm Malware Arsenal Overview

https://www.welivesecurity.com/2022/12/13/sandworm-malware-arsenal-overview/

Sandworm's Kapeka backdoor

https://www.withsecure.com/en/whats-new/newsroom/20240214-sandworm-s-kapeka-backdoor

CERT-UA Report on Sandworm Activity

https://cert.gov.ua/article/6276894

Microsoft: Threat intelligence report on Seashell Blizzard destructive campaigns

https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-novel-threat-actor/

BadPilot: Sandworm's Multi-Year Global Credential Harvesting Campaign

https://www.mandiant.com/resources/blog/sandworm-badpilot-credential-harvesting

Sandworm Disrupts Polish Energy Sector With New Wiper Malware

https://www.securityweek.com/sandworm-disrupts-polish-energy-sector-with-new-wiper-malware/

Sandworm - Tracking a Ukrainian Threat Actor

https://www.crowdstrike.com/blog/who-is-voodoo-bear/

Microsoft: Sandworm (IRIDIUM) APT44 Profile

https://www.microsoft.com/en-us/security/blog/threat-intelligence/

SentinelOne: AcidPour | New Variant of AcidRain Wiper Targeting Linux x86 Devices

https://www.sentinelone.com/labs/acidpour-new-variant-of-acidrain-wiper/

Sandworm APT: From KillDisks and Droppers to Incident Response Insights

https://www.trendmicro.com/en_us/research/24/d/sandworm-apt.html

Sandworm Uses New Malware to Target Ukraine

https://www.darkreading.com/cyberattacks-data-breaches/sandworm-uses-new-malware-to-target-ukraine

Sandworm APT Group Continues Targeting Ukraine with Destructive Campaigns

https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology

CERT-UA Report on APT44 (Sandworm) Activity

https://cert.gov.ua/article/6278502

Microsoft Threat Intelligence: Seashell Blizzard Operations 2024

https://www.microsoft.com/en-us/security/blog/2024/06/19/microsoft-digs-deep-on-seashell-blizzard-campaigns/

Sandworm: A decade of attacks on critical infrastructure

https://www.microsoft.com/en-us/security/blog/2024/01/31/ongoing-russian-cyberattacks-target-energy-infrastructure-in-europe/

Google TAG: BadPilot Sandworm subgroup analysis

https://blog.google/threat-analysis-group/sandworm-disrupts-power-ukraine-russian-invasion/

Sandworm: A New Era of Cyberwarfare

https://www.wired.com/story/sandworm-russia-ukraine-war/

Google Threat Intelligence Group: Sandworm APT44 Analysis

https://blog.google/threat-analysis-group/apt44-unearthing-sandworm/

Sandworm APT: From BlackEnergy to NotPetya to Olympic Destroyer - ESET

https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/

CERT-UA UAC-0082 Sandworm Activity Advisory

https://cert.gov.ua/article/3661104

BadPilot: Sandworm's Global Infrastructure Hunt

https://www.mandiant.com/resources/blog/badpilot-sandworm-infrastructure

Sandworm's Kapeka backdoor

https://www.welivesecurity.com/en/eset-research/sandworms-kapeka-backdoor/

Sandworm APT: A Technical Deep Dive into One of Russia's Most Destructive Cyber Threat Actors

https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology

ESET: AcidRain Wiper Analysis

https://www.welivesecurity.com/2022/03/15/acidrain-malware-viasat-modems/

ESET - New Kapeka backdoor linked to Sandworm APT group

https://www.welivesecurity.com/en/eset-research/new-kapeka-backdoor-linked-sandworm-apt-group/

Sandworm APT: From KillDisk to Prestige ransomware

https://www.welivesecurity.com/en/eset-research/sandworm-apt-from-killdisk-to-prestige-ransomware/

Sandworm's Adaptations in 2024: From Zero-Days to Edge Device Exploitation

https://www.mandiant.com/resources/blog/sandworm-apt44-edge-device-exploitation

APT44: Unearthing Sandworm - The Most Destructive Threat Actor in the World

https://www.mandiant.com/resources/reports/apt44-unearthing-sandworm

BadPilot: Sandworm's Long-Term Global Access Operations

https://www.mandiant.com/resources/blog/badpilot-sandworm-access-operations

SANDWORM: DISRUPTION, DISINFORMATION, AND DESTRUCTION - Mandiant

https://www.mandiant.com/resources/blog/sandworm-disruption-destruction

Microsoft Threat Intelligence: Seashell Blizzard Continues Attacks on Ukrainian Infrastructure

https://www.microsoft.com/en-us/security/blog/2024/01/17/seashell-blizzard-continues-attacks-targeting-ukraine/

Sandworm APT: From KillDisk to Exim Server Exploits

https://www.sentinelone.com/labs/sandworm-apt-from-killdisk-to-exim-server-exploits/

GRUE: The Sandworm APT's Advanced Phishing Campaign

https://www.mandiant.com/resources/blog/grue-sandworm-ukraine-recon

CERT-UA Report on Sandworm SwiftSlicer Campaign

https://cert.gov.ua/article/6278188

Microsoft AcidRain Wiper Analysis

https://www.microsoft.com/en-us/security/blog/2022/03/01/destructive-malware-targeting-ukrainian-organizations/

Unveiling Biasboat: A Sandworm Backdoor - ESET Research

https://www.welivesecurity.com/en/eset-research/unveiling-biasboat-sandworm-backdoor/

Microsoft: Satellite communications networks under active attack

https://www.microsoft.com/en-us/security/blog/2022/04/27/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/

Sandworm's Plots and Power Cuts - Andy Greenberg (2024)

https://www.wired.com/story/sandworm-russia-gru-unit-74455/

Google TAG: BadPilot: Sandworm's Multiyear Espionage Campaign

https://blog.google/threat-analysis-group/badpilot-sandworms-multiyear-espionage-campaign/

Sandworm Team: A Case Study in Russia's Cyber Warfare Capabilities

https://www.cisa.gov/sites/default/files/publications/MAR-10296782-1.v1.pdf

CERT-UA: UAC-0002 Sandworm Activity Reports

https://cert.gov.ua/articles/category/2

Sandworm APT: From KillDisk and Industroyer to Cyclops Blink and beyond

https://www.welivesecurity.com/2024/01/30/sandworm-apt-killdisc-industroyer-cyclops-blink-beyond/

Sandworm Disrupts Operations at 20 Critical Infrastructure Facilities in Ukraine

https://thehackernews.com/2024/10/sandworm-disrupts-operations-at-20.html

CERT-UA Report on Sandworm Activities

https://cert.gov.ua/article/3718487

Sandworm APT: From BlackEnergy to NotPetya and the Bad Rabbit ransomware

https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/

Sandworm Team and the Ukrainian Power Authority Attacks

https://www.cisa.gov/news-events/alerts/2016/02/25/ics-alert-ir-alert-h-16-056-01-cyber-attack-ukrainian-critical-infrastructure

CERT-UA: UAC-0002 (Sandworm) continues attacks on critical infrastructure

https://cert.gov.ua/article/155538

Microsoft: SEASHELL BLIZZARD continues to expand global espionage operations

https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/

ANSSI - Sandworm Intrusion Set Campaign Targeting Ukraine

https://www.cert.ssi.gouv.fr/cti/CERTFR-2022-CTI-001/

BadPilot: Sandworm's Long Game

https://www.mandiant.com/resources/blog/badpilot-sandworm-long-game

Seashell Blizzard continues to expand global compromise

https://www.microsoft.com/en-us/security/blog/2024/04/22/seashell-blizzard-continues-to-expand-global-compromise/

Sandworm APT Group Targets Ukraine with SwiftSlicer Wiper Malware

https://www.fortinet.com/blog/threat-research/sandworm-apt-group-targets-ukraine-with-swiftslicer-wiper-malware

Sandworm's Kapeka Backdoor Analysis

https://www.withsecure.com/en/whats-new/publications/kapeka

CERT-UA Report on Sandworm SwiftSlicer and RoarBAT Wipers

https://cert.gov.ua/article/6276688

Google TAG Report on Sandworm BadPilot Subgroup

https://blog.google/threat-analysis-group/badpilot-sandworm-subgroup-initial-access-operations/

Sandworm APT: From KillDisk to Exim - ESET Research

https://www.welivesecurity.com/en/eset-research/sandworm-apt-from-killdisk-to-exim/

NSA/FBI: Sandworm Drovorub Malware Advisory

https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

Microsoft Threat Intelligence: Seashell Blizzard Campaigns 2024

https://www.microsoft.com/en-us/security/blog/2024/06/13/seashell-blizzard-continues-targeting-ukraine-amid-evolving attacks/

ESET APT Activity Report - Sandworm

https://www.welivesecurity.com/en/eset-research/sandworm-group/

Russian GRU conducting global brute force campaign to compromise enterprise and cloud environments - NSA/FBI Joint Advisory

https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF

Kapeka: A novel backdoor spotted in Eastern Europe

https://www.welivesecurity.com/en/eset-research/kapeka-novel-backdoor-spotted-eastern-europe/

Sandworm's SwiftSlicer wiper targets Ukraine

https://www.welivesecurity.com/en/eset-research/sandworms-swiftslicer-wiper-targets-ukraine/

CERT-UA: UAC-0002 Activity Overview

https://cert.gov.ua/article/37626

Sandworm Team - Microsoft Threat Intelligence

https://www.microsoft.com/en-us/security/business/threat-intelligence/threat-actor-profiles

SANDWORM: APT44's Favorite Tools, Techniques, and Procedures

https://www.mandiant.com/resources/blog/apt44-sandworm-favorite-ttp

Sandworm Team and the Ukrainian Power Authority Attacks

https://www.dragos.com/blog/crashoverride/crashoverride-analysis-of-the-threat-to-electric-grid-operations/

Sandworm, a Destructive Cyberespionage Group

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a

CISA Cybersecurity Advisory: Sandworm APT Group Exploits Exim Mail Transfer Agent Vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

SentinelOne: AcidPour - Sandworm's Latest Wiper Malware

https://www.sentinelone.com/labs/acidpour-sandworms-latest-wiper-malware/

Sandworm Team and the Ukrainian Power Authority Attacks - Dragos

https://www.dragos.com/blog/industry-news/sandworm-team-and-the-ukrainian-power-authority-attacks/

Recorded Future: BadPilot Initial Access Subgroup

https://www.recordedfuture.com/research/badpilot-sandworm-access-operations

Mandiant APT44 Threat Profile

https://www.mandiant.com/resources/blog/apt44-uac-0133-sandworm-russia-threat-overview

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Sandworm's destructive operations continue to threaten Ukraine

https://www.microsoft.com/en-us/security/blog/2024/01/31/seashell-blizzard-continues-targeting-ukraine/

Microsoft: Seashell Blizzard intensifies global cyber espionage operations

https://www.microsoft.com/en-us/security/blog/2024/04/22/seashell-blizzard-intensifies-global-espionage-operations/

Kapeka: A new backdoor in Sandworm's arsenal

https://www.welivesecurity.com/en/eset-research/kapeka-new-backdoor-sandworms-arsenal/

Sandworm's Backdoor Campaign Through Malicious Ukrainian Websites

https://www.recordedfuture.com/research/sandworms-backdoor-campaign-malicious-ukrainian-websites

CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations

https://www.dragos.com/resource/crashoverride-analyzing-the-threat-to-electric-grid-operations/

SentinelLabs: AcidPour - Sandworm's New Wiper

https://www.sentinelone.com/labs/acidpour-sandworms-latest-data-wiper-variant/

Microsoft: Seashell Blizzard deploys new SwiftSlicer wiper

https://www.microsoft.com/en-us/security/blog/2024/01/17/seashell-blizzard-deploys-new-swiftslicer-wiper/

Google TAG: Sandworm Targeting Ukraine with Wipers and Backdoors

https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/

CISA: Russian State-Sponsored Cyber Actors Gain Network Access

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

BadPilot: Sandworm's Multi-Year Global Campaign

https://www.mandiant.com/resources/blog/badpilot-sandworm-campaign

KA-SAT Network cyber attack overview - CERT-EU

https://cert.europa.eu/publications/security-advisories/2022-042/

Microsoft Digital Defense Report 2023 - Seashell Blizzard

https://www.microsoft.com/en-us/security/business/security-insider/reports/microsoft-digital-defense-report-2023

ANSSI - Sandworm Intrusion Set Campaign Targeting Ukraine

https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf

Microsoft - Defending Ukraine: Early Lessons from the Cyber War

https://www.microsoft.com/en-us/security/blog/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/

Sandworm's AcidPour and AcidRain Wipers: Analysis

https://www.sentinelone.com/labs/acidpour-sandworms-latest-destructive-wiper-malware/

BadPilot: Sandworm APT Subgroup Exposed

https://www.mandiant.com/resources/blog/badpilot-sandworm-subgroup

CERT-UA Report on Sandworm Activity (UAC-0002)

https://cert.gov.ua/article/6281028

Google TAG: Sandworm Disruption Campaign

https://blog.google/threat-analysis-group/disrupting-sandworm-malware-infrastructure/

Sandworm's Kapeka backdoor analyzed by WithSecure

https://labs.withsecure.com/publications/kapeka-sandworms-new-backdoor

CERT-UA Reports on Sandworm Activity

https://cert.gov.ua/articles/category/apt

NSA/FBI/CISA Joint Advisory - Sandworm Actors Exploiting Vulnerability in Exim Mail Transfer Agent

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a

Sandworm APT Targets Ukraine with New SwiftSlicer Wiper

https://www.sentinelone.com/labs/sandworm-apt-targets-ukraine-with-new-swiftslicer-wiper/

Sandworm's KNUCKLETOUCH malware targets Ukraine

https://www.mandiant.com/resources/blog/sandworm-knuckletouch-ukraine

Sandworm APT: From KillDisk to Exim vulnerability exploitation

https://www.welivesecurity.com/en/eset-research/sandworm-apt-from-killdisk-to-exim-vulnerability-exploitation/

Sandworm Switches Focus: From Zero-Days to N-Days

https://www.mandiant.com/resources/blog/sandworm-compromises-edge-devices

Withsecure: Kapeka Backdoor Analysis

https://labs.withsecure.com/publications/kapeka-the-latest-sandworm-backdoor

Sandworm's RoarBAT: New malware linked to Ukraine attacks

https://www.welivesecurity.com/2023/01/12/roarbat-malware-sandworm-ukraine/

CISA Alert: Sandworm Threat Actor Exploits Multiple CVEs

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-037a

Sandworm APT: From KillDisk and Industroyer to Prestige and AcidRain

https://www.welivesecurity.com/2023/12/13/sandworm-apt-killdisk-industroyer-prestige-acidrain/

SentinelOne: AcidPour - Sandworm's Data Wiper for Linux

https://www.sentinelone.com/labs/acidpour-sandworms-latest-wiper-for-linux-systems/

Sandworm's KnuckleTouch and the Ubiquiti EdgeRouter Exploits

https://www.mandiant.com/resources/blog/sandworm-knuckletouch-ubiquiti-edgerouter-exploits

Sandworm APT Group Targets Ukrainian Entities with AcidPour Wiper

https://www.sentinelone.com/labs/acidpour-sandworm-continues-targeting-ukrainian-infrastructure/

Sandworm APT: From KillDisk and Industroyer to Prestige and Caddywiper

https://www.welivesecurity.com/2023/01/24/sandworm-apt-prestige-caddywiper/

Ukraine: Cyber Operations Tracking

https://www.mandiant.com/resources/blog/ukraine-cyber-operations-tracking

Sandworm's KnuckleTouch backdoor targets Ukraine and Eastern Europe

https://www.welivesecurity.com/en/eset-research/sandworms-knuckletouch-backdoor-targets-ukraine-eastern-europe/

Kapeka: A new backdoor tracked by Withsecure linked to Sandworm

https://labs.withsecure.com/publications/kapeka-a-new-backdoor-attributed-to-sandworm