Threat feed IOCs (21)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Sandworm. Each row shows why it was linked and where it came from.

Public research & publications (40)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• 2017-2021.state.govhttps://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html
• attack.mitre.orghttps://attack.mitre.org/groups/G0034
• blog-assets.f-secure.comhttps://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
• blog.googlehttps://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• services.google.comhttps://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf
• crowdstrike.comhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/
• dragos.comhttps://www.dragos.com/resource/electrum/
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html
• gov.ukhttps://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games
• infosecurity-magazine.comhttps://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/
• justice.govhttps://www.justice.gov/opa/page/file/1098481/download
• justice.govhttps://www.justice.gov/opa/press-release/file/1328521/download
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
• ncsc.gov.ukhttps://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/iron-viking
• dragos.comhttps://dragos.com/blog/crashoverride/CrashOverride-01.pdf
• us-cert.govhttps://www.us-cert.gov/ncas/alerts/TA17-163A
• ics.sans.orghttps://ics.sans.org/blog/2016/01/09/confirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid
• web.archive.orghttps://web.archive.org/web/20141016132823/https://www.symantec.com/connect/blogs/sandworm-windows-zero-day-vulnerability-being-actively-exploited-targeted-attacks
• ics.sans.orghttps://ics.sans.org/blog/2015/12/30/current-reporting-on-the-cyber-attack-in-ukraine-resulting-in-power-outage
• web.archive.orghttps://web.archive.org/web/20141224060545/http://blog.trendmicro.com/trendlabs-security-intelligence/timeline-of-sandworm-attacks/
• blog.googlehttps://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
• welivesecurity.comhttps://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf
• dragos.comhttps://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
• dragos.comhttps://dragos.com/adversaries.html
• welivesecurity.comhttp://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks
• welivesecurity.comhttps://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt
• welivesecurity.comhttps://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine
• welivesecurity.comhttps://www.welivesecurity.com/2017/05/23/xdata-ransomware-making-rounds-amid-global-wannacryptor-scare
• welivesecurity.comhttps://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine
• welivesecurity.comhttps://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back
• blog.googlehttps://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
• recordedfuture.comhttps://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine
• cert.gov.uahttps://cert.gov.ua/article/405538
• cip.gov.uahttps://cip.gov.ua/services/cm/api/attachment/download?id=60068
• packetstormsecurity.comhttps://packetstormsecurity.com/news/view/35790/Recent-OT-And-Espionage-Attacks-Linked-To-Russias-Sandworm-Now-Named-APT44.html
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm?linkId=9627235
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
• cert.gov.uahttps://cert.gov.ua/article/4279195