Loading story…
France’s cybersecurity agency ANSSI linked a multiyear intrusion campaign against several French organizations to the Russian GRU-associated Sandworm group, saying the attackers primarily compromised IT firms and web hosting providers between 2017 and 2020. Investigators said the victims were running obsolete, unsupported open-source Centreon software, and that some intrusions may have remained undetected for years. Centreon disputed broader implications for its customer base, arguing the affected deployments were insecure and unsupported and that the number of identified targets was limited.
ANSSI reported the deployment of the PAS backdoor and Exaramel malware, with command-and-control overlaps tying the activity to earlier Sandworm operations. Exaramel has previously been associated with the TeleBots toolset linked to Sandworm, reinforcing attribution to the same Russian military hacking apparatus behind disruptive campaigns such as NotPetya and Industroyer. Although French authorities did not identify a definitive end goal in this operation, the malware links and Sandworm’s history raised concern that the campaign went beyond routine espionage.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
ANSSI said the intrusion campaign persisted until 2020 and may have remained undetected for as long as three years. The agency said it could not determine the initial intrusion method used to compromise the Centreon servers.
ANSSI said a long-running intrusion campaign linked to the Russian GRU-associated Sandworm group began in late 2017 and targeted several French organizations, mostly IT firms and web hosting companies. The intrusions involved compromised servers running obsolete open-source Centreon software.
Centreon said no actual Centreon customers were affected, arguing the victims used an unsupported open-source version that had been obsolete for more than five years and was insecurely configured. The company said it was contacting customers and partners and recommended that anyone still using obsolete versions upgrade or seek assistance.
ANSSI published an advisory warning that hackers linked to Sandworm had breached several French organizations. The report described the victims as mostly IT firms and especially web hosting companies.
During the campaign, ANSSI found the PAS backdoor and Exaramel malware on compromised servers. It also observed command-and-control overlap with prior Sandworm activity, supporting the attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nozomi Networks reported that **Sandworm**—also tracked as **APT44**, **Seashell Blizzard**, and **Voodoo Bear**—moved from compromised IT environments into operational technology networks at 10 industrial organizations across seven countries, targeting systems tied to physical processes. Based on telemetry collected between July 2025 and January 2026, researchers identified 29 Sandworm-linked events involving aggressive lateral movement across hundreds of internal systems and direct interest in engineering workstations, HMIs, and field devices including **PLCs**, **RTUs**, and **IEDs**. The activity aligned with Moscow business hours, often peaking around Wednesday afternoons, reinforcing assessments that the group operates as a centrally managed Russian state sabotage actor tied to **GRU Unit 74455**. The report found that Sandworm largely did not rely on novel exploits, instead abusing unresolved prior compromises, older malware, and long-known, patchable tools. Every affected environment had generated high-confidence alerts for weeks or months before the intrusions escalated, with an average warning window of 43 days, and researchers said the group typically intensified operations after detection rather than withdrawing. Nozomi warned that basic controls—including rapid investigation of commodity alerts, remediation of legacy compromises, tighter lateral movement controls, and stronger IT/OT segmentation—remain critical because preventable security gaps are enabling Sandworm to reach industrial control assets.
Jun 29, 2026
Russian GRU-linked **Sandworm** has targeted Ukrainian organizations through multiple intrusion paths, including exploitation of vulnerable **Exim Mail Transfer Agent** servers and malware-laced Microsoft **KMS activation tools**. NSA reporting tied GRU operators to active exploitation of Exim for initial access, while newer reporting said Sandworm used trojanized software installers in cyber-espionage campaigns aimed at Ukrainian users, expanding the group’s access beyond perimeter-facing mail infrastructure. Researchers and media reports said the activity affected about **20 critical organizations in Ukraine**, underscoring Sandworm’s continued focus on high-value government and infrastructure targets. The combined reporting shows a sustained campaign that blends server-side exploitation with social engineering and malicious software distribution to establish footholds, steal information, and support disruptive operations associated with the Russian military intelligence apparatus.
Jul 12, 2026
Sandworm APT has conducted a targeted cyber espionage campaign against military entities in Belarus and Russia, including the Belarusian military and Russian Airborne Forces. The attackers leveraged malicious `.lnk` files and multi-stage PowerShell scripts to compromise systems, deploying backdoors that expose local services such as OpenSSH over the Tor network using obfs4 bridges. This infrastructure allows the threat actors to maintain persistent, anonymous access to compromised networks and evade traditional detection mechanisms. The infection chain often begins with decoy documents, such as nomination letters from military commanders, to lure victims into executing the malicious payloads. Once infected, the malware establishes persistence and configures the system to route sensitive services through Tor, enabling remote access via onion addresses. The campaign demonstrates a sophisticated approach to targeting high-value military personnel and infrastructure, with attribution pointing to the Sandworm APT group, known for its advanced capabilities and focus on Eastern European targets.
Jun 29, 2026