Loading story…
Researchers tied the SandCat hacking group to Uzbekistan’s State Security Service after a series of operational security failures exposed the actor’s infrastructure, malware development environment, and exploit activity. Kaspersky said it first identified the group after finding Chainshot malware and a zero-day exploit on a victim machine in the Middle East, then traced additional infrastructure and three more zero-days linked to the same operator. The investigation connected SandCat to Uzbekistan through infrastructure associated with the itt.uz domain, registration data referencing Military Unit 02616 in Tashkent, and network proximity between suspected development systems and state security email infrastructure.
Separate reporting documented phishing and web attacks targeting Uzbek human rights activists and independent media, aligning the broader campaign with domestic surveillance and repression objectives. Kaspersky said SandCat’s mistakes included using security software with telemetry enabled on development machines, uploading malware from operational IP addresses to VirusTotal, and leaving a screenshot of its in-development Sharpa platform inside a malicious test file. Those errors exposed tooling, infrastructure, and the apparent use of multiple purchased zero-day exploits, while also revealing overlap with exploit activity previously attributed to operators linked to Saudi Arabia and the United Arab Emirates.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
In October 2018, SandCat began developing its own attack platform, called Sharpa. Kaspersky later gained visibility into the platform through a screenshot embedded in a malicious Word test file.
In October 2018, Kaspersky discovered Chainshot malware on a victim machine in the Middle East and determined it had been installed using a zero-day exploit. This investigation became the starting point for uncovering the SandCat threat actor.
The article states that Uzbekistan's State Security Service appeared in Hacking Team emails leaked by Phineas Fisher in 2015. Those leaked records were later referenced alongside Kaspersky's SandCat findings.
According to Hacking Team emails leaked by Phineas Fisher, Uzbekistan's State Security Service spent nearly one million dollars on Hacking Team tools during the 2011 to 2015 period. The article cites this as earlier evidence of the service's surveillance procurement activity.
Registration information cited by Kaspersky showed the itt.uz domain was registered in 2008 to Military Unit 02616 in Tashkent, Uzbekistan. Kaspersky later used this infrastructure link as part of its attribution of SandCat to Uzbekistan's State Security Service.
Kaspersky researcher Brian Bartholomew presented the company's findings about SandCat at the VirusBulletin conference in London. The presentation described the group's operational security failures, exposed infrastructure, and burned zero-days.
Kaspersky researchers identified a threat actor they named SandCat and assessed it to be linked to Uzbekistan's State Security Service. Their investigation also uncovered three additional zero-day exploits used by the same group and tied its infrastructure to itt.uz and nearby SSS-linked IP space.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian GRU-linked **Sandworm** has targeted Ukrainian organizations through multiple intrusion paths, including exploitation of vulnerable **Exim Mail Transfer Agent** servers and malware-laced Microsoft **KMS activation tools**. NSA reporting tied GRU operators to active exploitation of Exim for initial access, while newer reporting said Sandworm used trojanized software installers in cyber-espionage campaigns aimed at Ukrainian users, expanding the group’s access beyond perimeter-facing mail infrastructure. Researchers and media reports said the activity affected about **20 critical organizations in Ukraine**, underscoring Sandworm’s continued focus on high-value government and infrastructure targets. The combined reporting shows a sustained campaign that blends server-side exploitation with social engineering and malicious software distribution to establish footholds, steal information, and support disruptive operations associated with the Russian military intelligence apparatus.
Jul 12, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026