Sandworm
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 73 incidents
- Sources
- 81 sources
- First seen
- 2014-08-09
- Last seen
- 2025-12-29
- Updated
- 2026-10-03 02:12
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Voodoo Bear, also tracked as UAC-0082, Sandworm and APT44, is a Russia‑linked threat actor associated with the GRU military intelligence unit 74455. The group conducts both espionage and disruptive operations, primarily targeting energy sector organizations in Poland and Ukraine, as well as Ukrainian governmental, media, logistics and grain sector entities. Its tactics include exploiting internet‑exposed devices protected by default credentials and lacking multi‑factor authentication, deploying wiper malware such as DynoWiper, CaddyWiper, ZeroWipe, SDelete, AwfulShred and BidSwipe, using Group Policy Objects for centralized malware distribution, leveraging ICS‑focused tools like Industroyer/Industroyer2 and BlackEnergy, employing supply‑chain compromises (poisoned software, abused vendor maintenance access) and utilizing TOR relay infrastructure for command and control. Notable publicly reported campaigns include the December 2025 wiper attack on Poland’s wind and solar farms and combined heat‑and‑power plants, the March 2024 intrusion against approximately twenty Ukrainian critical‑infrastructure facilities using QUEUESEED, BIASBOAT and LOADGRIP malware, the January 2023 data‑wiping operation against Ukraine’s national news agency Ukrinform via GPO‑distributed CaddyWiper and related wipers, the 2017 NotPetya global ransomware/wiper attack, and the 2015‑2016 BlackEnergy‑enabled power‑grid outages in Ukraine.
Incidents
Attributed incidents are available to members.
73 incidentsSources
Sources available to members: 81 sources.