Sandworm TeamThreat actor
- APT44
- blackenergy (group)
- blue echidna
- electrum
- frozenbarents
- g0034
- iridium
- iron viking
- quedagh
- Sandworm
- SANDWORM RELIC
- seashell blizzard
- telebots
- temp.noble
- uac-0082
- uac-0113
- UAC-0145
- voodoo bear
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009.From MITRE ATT&CK
Last reported yesterday, by The Hacker News29 reports
ATT&CK techniques
6 of 70 · each with the sentence it comes from- T1053.005Scheduled Task
“According to ESET telemetry, the events unfolded as follows: at 06:59 on July 16th, 2025, a scheduled task named pdfopentask was executed on one machine in the target organization.”
- T1684Social Engineering
“ClickFix has become an exceedingly popular social engineering technique over the past two years.”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1071.001Web Protocols
“T1071.001”
- T1485Data Destruction
“T1485”
- T1132.001Standard Encoding
“T1132.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
29 reports · the newest 20, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Sandworm wipes Ukrainian grain logistics firm: A Russian military cyber unit has wiped the internal systems of a Ukrainian company involved in grain export logistics.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“This report analyzes activity during which UAC‑0099 gained initial access on July 16th, 2025 and handed it off to Sandworm, which then conducted a data-wiping attack on September 17th, 2025.”
-
Russian hackers teamed up to wipe data at Ukrainian grain firm“The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday.”
-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“Noteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm which are all Russia linked.”
-
MATCHBOIL: nuevos trucos, las mismas intenciones maliciosas“UAC-0099 también puede actuar como initial access broker para Sandworm, un grupo alineado con Rusia conocido principalmente por sus ataques destructivos contra Ucrania.”
-
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML“ESET, in its APT Activity Report published in November 2025, said the cyber espionage crew can serve as an initial access broker for Sandworm, a Russian advanced persistent threat (APT) group best known for its destructive attacks against Ukraine.”
-
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor“Let’s remember that this group has been an initial access broker of Sandworm, another Russia-aligned APT group, so it is possible they are seeking victims that can be of interest for other APT groups that UAC-0099 can assist.””
-
MATCHBOIL: New tricks, same old evil intentions“UAC-0099 can act as an initial access broker for Sandworm, a Russia-aligned group best known for its destructive attacks in Ukraine.”
-
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits“Another nation-state threat actor linked to the use of ClickFix is Sandworm.”
-
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink“'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink”
-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“SANDWORM RELIC, the Russian cyber espionage group formerly known as FROZENBARENTS, SANDWORM, and APT44, has integrated Gemini to support intelligence gathering, social engineering, and workflow automation in continued operations targeting Ukraine.”
-
Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL“That report detailed a late 2025 cyber-attack on Poland's energy infrastructure involving wiper malware and attributed to Sandworm, a Russian state-backed APT group.”
-
Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування“Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування”
-
Вектори первинної компрометації UAC-0145 станом на липень 2026 року“Вектори первинної компрометації UAC-0145 станом на липень 2026 року”
-
The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem“…ssian: НТЦ Вулкан) worked with the Russian intelligence services, including providing tooling and support for the GRU unit that sponsors APT44 activity.”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…AC-0099, alineado con Rusia, llevó a cabo operaciones de acceso inicial y posteriormente transfirió objetivos validados a Sandworm para actividades posteriores.”
-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“Sandworm intensificó la actividad destructiva durante el invierno, desplegando varios nuevos wipers en Ucrania contra objetivos del sector gubernamental y privado.Particularmente notable fue un incidente de destrucción de datos en diciembre de 2025 que afectó…”
-
ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025“ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025”
Indicators in its reports
named in the reports above- f886b615cb9e23ea…55acfb04ce9ein 2 reports
- 1e2c4aac30edff86…99bcd3d0cccein 2 reports
- c85d28f7d272ce2b…1bf25b8d00fcin 2 reports
- 050926727cdd74f0…76d10fb06b14in 2 reports
- b6569b0050b864c4…c2d3852a3958in 2 reports
- a926889bab31f3c3…e862ef367028in 2 reports
- 026f892630d0a4fe…ba99af0022c4in 2 reports
- 6d72b56b86fd5ed9…c69476f836e7in 2 reports
- virtualdailyplanner[.]proin 2 reports
Copy these 9 indicators · defanged
Thanks — we review every report.