Sandworm

THREAT ACTOR PROFILE

Sandworm

Sandworm is a Russian state-sponsored group linked to the GRU and active since at least 2009. It is behind the 2015 Ukraine power grid blackout and the 2017 NotPetya outbreak, and still combines espionage with destructive attacks on energy and other critical infrastructure, with Ukraine as its main focus.

Russian Federation (GRU)

Government / Private Sector

First seen

2009

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

APT44, Seashell Blizzard and three CERT-UA cluster IDs

Ukraine's CERT-UA tracks Sandworm activity under numbered clusters, and the 2026 fake recruiter campaign was published as UAC-0145. If you follow CERT-UA alerts, those IDs are the fastest way to spot this group.

Every name below points to one entry in our threat actor DB, so IOCs from Mandiant's APT44 reporting and CERT-UA's UAC-0145 alerts sit together.

GROUP PROFILE

GRU sabotage unit with a grid-blackout track record

Sandworm mixes intelligence collection with sabotage. Our record covers BlackEnergy, NotPetya, attacks through compromised SOHO devices, hacktivist personas used as cover and the use of legitimate cloud services to stay hidden.

Ukraine remains the main target, but our records also list Poland, Lithuania, Georgia, Azerbaijan, Kazakhstan, Israel and others. In late December 2025, Polish energy companies were hit with a new wiper that ESET and CERT Polska tied to Russian state-aligned activity.

Recent tradecraft shows a group comfortable on network appliances and in long, quiet access. Cisco Talos linked a 2026 firewall intrusion cluster to Sandworm, and CERT-UA tracked months of fake job interviews aimed at IT administrators.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Firewalls, fake job offers and Tor-hidden SSH

The stages below come from Sandworm activity documented in posts we track on our IOC Hunter feed, from late 2025 into 2026.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Cyclops Blink on firewalls, DynoWiper on Polish energy

Initial Access

CVES EXPLOITED

Two Cisco FMC flaws chained for root

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

Sandworm

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Sandworm

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Sandworm

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Firewall implants and recruiter lures in 2026

The latest reports show Sandworm working two angles at once: edge appliances that nobody watches closely, and IT staff who already have privileged access.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.