Loading threat actor…
UAC-0002, also known as Sandworm, APT44, and Seashell Blizzard, is a threat actor associated with destructive cyberattacks and sustained network-compromise operations targeting Ukraine. Its targets include critical infrastructure, government institutions, military personnel, logistics providers, industrial automation suppliers, grain-handling equipment manufacturers, and IT specialists. Supplier-focused campaigns have also targeted organizations in Czechia and Serbia. CERT-UA tracks UAC-0145 and UAC-0212 as subclusters of UAC-0002 and has linked the destructive-attack planning cluster UAC-0133 to it with high confidence. The actor compromises suppliers to acquire information and access that can facilitate subsequent attacks against critical infrastructure customers. Its operations have included planning destructive attacks against Ukrainian energy, water-supply, and heating enterprises, as well as establishing access that enabled a destructive attack against a Ukrainian central executive authority. Following initial compromise, operators can move laterally within hours and establish footholds on servers, network equipment, and additional workstations. Initial-access techniques include prolonged social engineering, impersonation of prospective customers and recruiters, trojanized software installers distributed through torrent trackers, malicious Excel XLL add-ins, messenger-based lures posing as antivirus protection, and ClickFix-style fake CAPTCHA pages. Supplier campaigns have combined PDF-linked lures, exploitation of CVE-2024-38213, and disguised Windows shortcut files to execute PowerShell and deploy malware. Recruitment-themed operations have used a modified WireGuard client branded SopraVPN to execute concealed payloads on Windows and Linux. The malware ecosystem includes SECONDBEST/EMPIREPAST, SPARK, CROOKBAG, GHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL, SMARTAXE, and the Android backdoor COWARDDUCK. The actor uses scheduled tasks, startup mechanisms, and registry autorun entries for persistence; OpenSSH and Tor for unauthorized remote access and tunneling; and rsync for document and messenger-data exfiltration. Its collection capabilities include system reconnaissance, theft of keys and messenger data, and collection of Android files, contacts, device information, and real-time geolocation. Payload encryption, custom encoding, traffic filtering, and abuse of legitimate services support concealment and delivery.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
26 malware families Mallory has associated with this actor across public reporting.
21 additional families tracked in Mallory.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
221 indicators attributed to this actor. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.