Sandworm

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia

Primary Aliases: APT44 Seashell Blizzard UNC3810 VOODOO BEAR

Sponsor / State Affiliation Russian Federation (GRU Unit 74455)

Primary Motivation Geopolitical sabotage, military operational support, and large-scale disruption of civilian and government services.

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Ukrainian Energy Sector Sabotage, Destructive Wiper Operations, Satellite and Communication Disruption

⚔️ Weaponized CVE Matrix (3)

EternalBlue SMBv1

CVSS 8.1 KEV EPSS 97.1%

Citrix ADC Path Traversal

CVSS 9.8 KEV EPSS 96.4%

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Energy Government Telecommunications Water & Wastewater Transportation Defense Critical Infrastructure Satellite Communications

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 3

T1566 Spear-phishing

T1566 Supply chain compromise

T1566 Exploitation of edge devices and public-facing applications

Execution 2

T1059 Living-off-the-land (LotL) techniques

T1059 Credential harvesting and lateral movement via SMB/WMI

Exfiltration & Impact 1

T1485 Wiper malware deployment (e.g., CaddyWiper, AcidRain)

Operational Techniques 1

T1000 Industrial Control Systems (ICS/SCADA) manipulation

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Head Mare APT Exploits TrueConf Server Vulnerabilities to Deploy PhantomCore and PhantomGraph

Attacks and Vulnerabilities 2026-08-13

[DEEP DIVE] UAC-0145 Sandworm ClickFix CAPTCHA and Ethereum-based SMARTAXE C2

Attacks and Vulnerabilities 2026-07-20

Copied to clipboard

LINK COPIED TO CLIPBOARD