🇷🇺 Sandworm

Profile

Sandworm is a Russia-linked threat actor group known for destructive attacks against Ukraine. Recent reporting highlights the use of a new mesh network backdoor in a destructive attack and collaboration with other Russian hackers to wipe data at a Ukrainian grain firm. The group has also chained Cisco vulnerabilities to deploy Cyclops Blink malware, and there are indications of SANDWORM_MODE related to AI toolchain supply chain attacks.