# Sandworm

> As of 2026-10-23, Sandworm is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 12 threats spanning apt, ics scada, malware. Also known as Seashell Blizzard, Static Tundra, Void Manticore, Red Sandstorm. ATT&CK coverage spans 203 techniques across 26 tactics in 12 of 12 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1485 (Data Destruction), T1003 (OS Credential Dumping).

- **Nation:** Russia
- **Tracked threats:** 12
- **Categories:** APT, ICS_SCADA, MALWARE, THREAT_INTEL, VULNERABILITY, CAMPAIGN
- **Also known as:** Seashell Blizzard, Static Tundra, Void Manticore, Red Sandstorm, DragonForce, APT44, Sandworm Team - G0034, Blue Echidna, ELECTRUM, FROZENBARENTS, G0034, IRIDIUM
- **As of:** 2026-10-23

## ATT&CK techniques observed

203 techniques observed across 12 of 12 tracked threats. Tactics: Stealth (formerly Defense Evasion) (21), Impact (17), Command and Control (14), Persistence (14), Discovery (12), Execution (12).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 8 of 12 tracked threats
- [T1485](https://intel.threadlinqs.com/technique/T1485) Data Destruction — Impact — observed in 8 of 12 tracked threats
- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 7 of 12 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 7 of 12 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 7 of 12 tracked threats
- [T1566](https://intel.threadlinqs.com/technique/T1566) Phishing — Initial Access — observed in 7 of 12 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 6 of 12 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 6 of 12 tracked threats
- [T1133](https://intel.threadlinqs.com/technique/T1133) External Remote Services — Initial Access — observed in 6 of 12 tracked threats
- [T1570](https://intel.threadlinqs.com/technique/T1570) Lateral Tool Transfer — Lateral Movement — observed in 6 of 12 tracked threats
- [T1053](https://intel.threadlinqs.com/technique/T1053) Scheduled Task/Job — Persistence — observed in 5 of 12 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 5 of 12 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 5 of 12 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 5 of 12 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 5 of 12 tracked threats

## Tracked threats

- [UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)](https://intel.threadlinqs.com/threat/TL-2026-4127) — HIGH
- [Kaspersky ICS-CERT Q1 2026 Review: Sandworm/Static Tundra Wiper Hits Polish Energy Grid, Suspected Iran Intrusion at NCBJ Nuclear Centre, Void Manticore's Handala Persona Wipes 200,000 Stryker Devices, DragonForce Ransomware Disrupts Hazeldenes Poultry](https://intel.threadlinqs.com/threat/TL-2026-2420) — HIGH
- [Sandworm-linked UAC-0145 Uses Fake Job Offers to Deliver Trojanized WireGuard VPN Client (SopraVPN)](https://intel.threadlinqs.com/threat/TL-2026-1988) — HIGH
- [Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy — Sandworm/APT44 Redesignated SANDWORM RELIC](https://intel.threadlinqs.com/threat/TL-2026-1730) — INFO
- [Pro-Russia Hacktivists (CARR/Z-Pentest/NoName057/Sector16) — GRU Unit 74455-Linked OT/ICS Attacks on US and Global Critical Infrastructure via VNC Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0125) — CRITICAL
- [State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database Exfiltration, Infamous Chisel Android Malware (APT44/Sandworm, Turla, UNC5792, UNC4221, UNC1151)](https://intel.threadlinqs.com/threat/TL-2026-0111) — HIGH
- [Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities](https://intel.threadlinqs.com/threat/TL-2026-0053) — CRITICAL
- [IPIDEA Residential Proxy Botnet Disruption by Google](https://intel.threadlinqs.com/threat/TL-2026-0042) — HIGH
- [CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against Ukraine](https://intel.threadlinqs.com/threat/TL-2026-0041) — CRITICAL
- [Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar Farms](https://intel.threadlinqs.com/threat/TL-2026-0037) — CRITICAL
- [Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWiper](https://intel.threadlinqs.com/threat/TL-2026-0014) — CRITICAL
- [Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-0004) — CRITICAL

## Related CVEs

13 CVEs referenced by tracked Sandworm activity.

- [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509)
- [CVE-2024-2617](https://intel.threadlinqs.com/cve/CVE-2024-2617)
- [CVE-2023-36884](https://intel.threadlinqs.com/cve/CVE-2023-36884)
- [CVE-2023-23397](https://intel.threadlinqs.com/cve/CVE-2023-23397)
- [CVE-2022-30190](https://intel.threadlinqs.com/cve/CVE-2022-30190)
- [CVE-2021-40444](https://intel.threadlinqs.com/cve/CVE-2021-40444)
- [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472)
- [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688)
- [CVE-2019-19781](https://intel.threadlinqs.com/cve/CVE-2019-19781)
- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379)
- [CVE-2017-11882](https://intel.threadlinqs.com/cve/CVE-2017-11882)
- [CVE-2017-0199](https://intel.threadlinqs.com/cve/CVE-2017-0199)
- [CVE-2014-4114](https://intel.threadlinqs.com/cve/CVE-2014-4114)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Sandworm