Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows
An advanced recruitment-themed intrusion campaign attributed to UAC-0145, a cluster that includes subcluster UAC-0002, also tracked as Sandworm, APT44 and Se...
Sandworm
GRU Unit 74455 responsible for destructive attacks including NotPetya, attacks on Ukrainian power grid, and Olympic Destroyer. Considered one of the most aggressive threat actors.
Also known as: sandworm, voodoo bear, iridium, seashell blizzard, quedagh, electrum, iron viking, blackenergy group
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
Last 90 Days (6)
Last 90 Days
All Time
Sandworm hackers target IT pros with trojanized WireGuard VPN client
Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at lea...
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state thr...
Russian military hackers pose as recruiters to target Ukrainian IT workers
Ukraine’s computer emergency response team, CERT-UA, said Saturday that the campaign has been running since at least May and is linked to Sandworm, the notor...
Ukraine warns fake CAPTCHAs are being used to make you hack yourself
Ukraine's computer emergency response team, CERT-UA, has warned that the Kremlin-backed Sandworm hacking group is leveraging fake CAPTCHA checks on compromis...