Loading threat actor…
Sandworm is a Russian state-sponsored threat actor associated with the Main Intelligence Directorate (GRU), identified as Unit 74455. Widely used tracking names include APT44, Sandworm Team, Seashell Blizzard, Voodoo Bear, Iron Viking, ELECTRUM, BlackEnergy Group, and TeleBots. Its operations combine destructive attacks, critical-infrastructure disruption, and espionage, with Ukraine a principal target. Sandworm is responsible for attacks against Ukraine’s electricity grid and the NotPetya outbreak. The group obtains access through spearphishing links, exploitation of vulnerabilities, compromised software supply chains, and external remote services. It distributed NotPetya through a malicious update to the Ukrainian accounting application M.E.Doc and has used VPN connections within compromised software-provider infrastructure to reach customer networks. Its operational techniques include vulnerability scanning, LDAP-based Active Directory discovery, credential dumping with a modified Mimikatz tool, abuse of legitimate credentials, and lateral payload distribution through network shares and Group Policy. Persistence mechanisms include creating domain accounts on industrial-control access servers, manipulating account access, and deploying a Dropbear SSH backdoor. Its backdoors employ encoded and encrypted communications and payloads. Sandworm has deployed Prestige ransomware and has been linked by US and UK authorities to Cyclops Blink, a modular implant targeting network appliances that can persist through reboots and firmware updates. UAC-0145, identified as a Sandworm branch, has targeted Ukrainian users through compromised websites displaying fake CAPTCHA checks. These ClickFix lures persuade victims to execute PowerShell commands that deploy ScoutCurl for reconnaissance of system configuration, installed software, files, and browser information.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
76 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
40 malware families attributed to this actor across reporting.
35 additional families tracked in Mallory.
31 CVEs this actor has used in observed campaigns. 31 of them exploited in the wild.
Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).
CVE-2026-20079 is described as a maximum-severity authentication bypass vulnerability in Cisco Secure FMC that allows an unauthenticated remote attacker to execute arbitrary code and gain root access. Attackers are chaining it with CVE-2026-20316 to deploy Cyclops Blink.
As recently as November 2025, an email phishing wave targeting Ukraine was found to deliver the implant via RAR archives that exploit CVE-2025-8088, a WinRAR vulnerability that has been exploited by a number of Russian hacking groups such as Sandworm, Gamaredon, and RomCom.
CVE-2026-20316 has a CVSS score of 5.3 and allows a remote attacker to log in with low privileges, then use other previous FMC vulnerabilities to escalate privileges. UAT 11988 is exploiting it to distribute Qilin ransomware.
The Shadow Brokers leak included EternalBlue, an exploit for Windows SMB. The content links it to WannaCry and to the Sandworm-attributed NotPetya attack, and states that Microsoft released MS17-010 in March 2017.
26 more CVEs tied to this actor tracked in Mallory.
315 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only in an attribution analogy illustrating how analysts distinguish Russian threat actors. The article does not connect Sandworm to the Ukrainian phishing campaign.
The article attributes Prestige ransomware deployment against organizations in Ukraine and Poland to Sandworm, describing domain-wide distribution through administrative shares and Group Policy. It also describes GPO-based wiper deployment. The article explicitly cautions that its attribution and technical details were not independently verified.
A threat actor linked to Russian military intelligence that ESET identifies as a possible recipient of initial access provided by UAC-0099. The content does not establish this relationship or attribute the described malware campaign directly to Sandworm.
Russian military-intelligence-linked threat actor associated with destructive attacks against Ukrainian power grids and other infrastructure. The article identifies it as a possible recipient of initial access supplied by UAC-0099, without establishing its direct involvement in the MatchBoil campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.