Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-02

Sandworm

Also known as:Seashell BlizzardStatic TundraHandala Hack TeamDragonForceVoid ManticoreRed SandstormAPT44Sandworm Team - G0034Blue EchidnaELECTRUMFROZENBARENTSG0034

As of 2026-10-30, Sandworm is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 13 threats spanning threat intel, apt, ics scada. Also known as Seashell Blizzard, Static Tundra, Handala Hack Team, DragonForce. ATT&CK coverage spans 207 techniques across 26 tactics in 13 of 13 tracked threats. Most-observed techniques: T1485 (Data Destruction), T1005 (Data from Local System), T1003 (OS Credential Dumping).

Tracked threats
136 critical · 6 high
First seen
2026-02-02
Last seen
2026-10-30
ATT&CK techniques
207across 13 of 13 threats
Related CVEs
14Referenced by its activity
Attribution
RussiaNation or origin
Nation: Russia · 13 tracked threat(s) · Categories: THREAT_INTEL, APT, ICS_SCADA, MALWARE, VULNERABILITY, CAMPAIGN

Activity timeline

Sandworm appears in 13 tracked threats between and ; the busiest month was 2026-02 with 8 reports.

ATT&CK techniques observed

207 techniques observed across 13 of 13 tracked threats · Stealth (formerly Defense Evasion) (21), Impact (17), Persistence (15), Command and Control (14), Discovery (13), Resource Development (13)
  • T1485 Data Destruction — Impactobserved in 9 of 13 tracked threats
  • T1005 Data from Local System — Collectionobserved in 8 of 13 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 7 of 13 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 7 of 13 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 7 of 13 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 7 of 13 tracked threats
  • T1566 Phishing — Initial Accessobserved in 7 of 13 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 6 of 13 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 6 of 13 tracked threats
  • T1059.001 PowerShell — Executionobserved in 6 of 13 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 6 of 13 tracked threats
  • T1570 Lateral Tool Transfer — Lateral Movementobserved in 6 of 13 tracked threats
  • T1053 Scheduled Task/Job — Persistenceobserved in 5 of 13 tracked threats
  • T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 5 of 13 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 5 of 13 tracked threats

Tracked threats

Related CVEs

14 CVEs referenced by tracked Sandworm activity