Loading story…
Russian GRU-linked Sandworm has targeted Ukrainian organizations through multiple intrusion paths, including exploitation of vulnerable Exim Mail Transfer Agent servers and malware-laced Microsoft KMS activation tools. NSA reporting tied GRU operators to active exploitation of Exim for initial access, while newer reporting said Sandworm used trojanized software installers in cyber-espionage campaigns aimed at Ukrainian users, expanding the group’s access beyond perimeter-facing mail infrastructure.
Researchers and media reports said the activity affected about 20 critical organizations in Ukraine, underscoring Sandworm’s continued focus on high-value government and infrastructure targets. The combined reporting shows a sustained campaign that blends server-side exploitation with social engineering and malicious software distribution to establish footholds, steal information, and support disruptive operations associated with the Russian military intelligence apparatus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting published on April 22, 2024 said Russian Sandworm hackers had targeted 20 critical organizations in Ukraine. The disclosure marked an escalation in publicly known scope by identifying the number of affected critical-sector organizations.
EclecticIQ reported that Sandworm targeted Ukrainian users in cyber-espionage campaigns using trojanized Microsoft KMS activation tools. The activity was attributed to the Russian state-backed group and described as part of ongoing operations against Ukraine.
The U.S. National Security Agency disclosed that Russian GRU cyber actors were actively exploiting a critical Exim Mail Transfer Agent vulnerability. The notice publicly tied the exploitation activity to Russian military intelligence operators and warned organizations to patch affected systems.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceblog.eclecticiq.com
Open sourceweb.archive.org
Open sourcensa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian state-backed hacking group **Sandworm** has intensified its use of data-wiping malware in Ukraine, specifically targeting the country's grain sector, government, education, energy, and logistics organizations. According to ESET's APT Activity Report, Sandworm deployed destructive malware such as `ZEROLOT` and `Sting` in attacks during June and September 2025, aiming to disrupt Ukraine's vital economic infrastructure. These operations are part of a broader pattern of Russian cyber aggression, with Sandworm's campaigns standing out for their focus on sabotaging Ukraine's wartime economy by striking at its main revenue source—grain exports. The attacks leveraged multiple data-wiping malware families, which are designed to irreversibly destroy digital information by corrupting files, disk partitions, and master boot records. Unlike ransomware, these wipers serve purely as tools of sabotage, not extortion. The targeting of the grain sector marks a notable escalation, as previous wiper campaigns primarily focused on government and critical infrastructure. ESET's findings highlight the ongoing evolution and increasing sophistication of Russian APT activity, with Sandworm's destructive operations representing a significant threat to Ukraine's economic stability during the ongoing conflict.
Jun 29, 2026
Ukrainian electric utilities suffered a coordinated cyberattack that caused power outages for civilians, marking one of the clearest cases of a cyber operation producing a real-world disruption of critical infrastructure. Reporting from iSIGHT Partners and SANS ICS assessed with high confidence that the outage was intentional and attributed the intrusion to **Sandworm Team**, citing the presence of **BlackEnergy 3** malware in affected environments and the use of the destructive component **KillDisk** during the operation. U.S. government industrial control system alerts later documented the incident as a cyberattack against Ukrainian critical infrastructure and tied it to a broader, ongoing malware campaign targeting ICS environments. The reporting said **KillDisk** may have been used less to trigger the outage than to hinder restoration and operator visibility after the attack, while flooding utility call centers with phone traffic likely complicated response efforts; the incident also fit Sandworm’s wider pattern of targeting Ukrainian entities, regional power organizations, and other government and media networks while showing sustained interest in **SCADA** and industrial control systems.
Jun 29, 2026
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026