Sandworm

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia

Primary Aliases: APT44 Seashell Blizzard UNC3810 VOODOO BEAR

Sponsor / State Affiliation Russian Federation (GRU Unit 74455)

Primary Motivation Sabotage, political disruption, and military support

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Ukrainian Critical Infrastructure Sabotage, European Government Espionage and Disruption

⚔️ Weaponized CVE Matrix (3)

EternalBlue SMBv1

CVSS 8.1 KEV EPSS 97.1%

Citrix ADC Path Traversal

CVSS 9.8 KEV EPSS 96.4%

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Energy Infrastructure Government Services Telecommunications Defense Industrial Base Transportation Satellite Communications Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 3

T1566 Spear-phishing

T1566 Supply chain compromise

T1566 Exploitation of public-facing edge devices

Execution 1

T1059 Living-off-the-land (LotL) techniques

Credential Access & Discovery 1

T1003 Credential harvesting

Exfiltration & Impact 1

T1485 Wiper malware deployment (e.g., CaddyWiper, IsaacWiper)

Operational Techniques 1

T1000 Industrial Control Systems (ICS/SCADA) manipulation

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Head Mare APT Exploits TrueConf Server Vulnerabilities to Deploy PhantomCore and PhantomGraph

Attacks and Vulnerabilities 2026-08-13

[DEEP DIVE] UAC-0145 Sandworm ClickFix CAPTCHA and Ethereum-based SMARTAXE C2

Attacks and Vulnerabilities 2026-07-20

Copied to clipboard

LINK COPIED TO CLIPBOARD