Activity timeline
Sandworm appears in 11 tracked threats between and ; the busiest month was 2026-02 with 8 reports.
ATT&CK techniques observed
- T1003 OS Credential Dumping — Credential Accessobserved in 7 of 11 tracked threats
- T1005 Data from Local System — Collectionobserved in 7 of 11 tracked threats
- T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 7 of 11 tracked threats
- T1059 Command and Scripting Interpreter — Executionobserved in 7 of 11 tracked threats
- T1485 Data Destruction — Impactobserved in 7 of 11 tracked threats
- T1566 Phishing — Initial Accessobserved in 7 of 11 tracked threats
- T1021 Remote Services — Lateral Movementobserved in 6 of 11 tracked threats
- T1133 External Remote Services — Initial Accessobserved in 6 of 11 tracked threats
- T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 5 of 11 tracked threats
- T1053 Scheduled Task/Job — Persistenceobserved in 5 of 11 tracked threats
- T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 5 of 11 tracked threats
- T1071 Application Layer Protocol — Command and Controlobserved in 5 of 11 tracked threats
- T1078 Valid Accounts — Initial Accessobserved in 5 of 11 tracked threats
- T1110 Brute Force — Credential Accessobserved in 5 of 11 tracked threats
- T1489 Service Stop — Impactobserved in 5 of 11 tracked threats
Tracked threats
- Kaspersky ICS-CERT Q1 2026 Review: Sandworm/Static Tundra Wiper Hits Polish Energy Grid, Suspected Iran Intrusion at NCBJ Nuclear Centre, Void Manticore's Handala Persona Wipes 200,000 Stryker Devices, DragonForce Ransomware Disrupts Hazeldenes PoultryHIGH
- Sandworm-linked UAC-0145 Uses Fake Job Offers to Deliver Trojanized WireGuard VPN Client (SopraVPN)HIGH
- Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy — Sandworm/APT44 Redesignated SANDWORM RELIC
- Pro-Russia Hacktivists (CARR/Z-Pentest/NoName057/Sector16) — GRU Unit 74455-Linked OT/ICS Attacks on US and Global Critical Infrastructure via VNC ExploitationCRITICAL
- State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database Exfiltration, Infamous Chisel Android Malware (APT44/Sandworm, Turla, UNC5792, UNC4221, UNC1151)HIGH
- Default ICS Credentials Exploited in Destructive Attack on Polish Energy FacilitiesCRITICAL
- IPIDEA Residential Proxy Botnet Disruption by GoogleHIGH
- CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against UkraineCRITICAL
- Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar FarmsCRITICAL
- Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWiperCRITICAL
- Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy InfrastructureCRITICAL