← threat actors
threat actor · RU
Sandworm
also tracked as uac 0099 2, uac 0145 2, apt44 1
7 stories · 6 in the wild · July 17, 2026 – October 25, 2026
evidence: 4 observed · 2 attempted
how they got in
- phishing email 3 · Oct 25
- exposed service 1 · Sep 10
- fake recruiter 1 · Aug 11
sectors
- government 4 · Sep 10
- transport 2 · Oct 25
- defense 1 · Sep 10
- finance 1 · Sep 10
- consumers 1 · Jul 20
geography
- ukraine 5 · Oct 25
- russia 1 · Sep 3
malware and tools
- mythicratatoskr 1 · Oct 23
- cyclops blink 1 · Sep 10
techniques
- backdoor 2 · Oct 25
- credential access 2 · Sep 10
- data wiping 1 · Oct 23
- auth bypass 1 · Sep 10
- exfiltration 1 · Sep 10
- living off the land 1 · Sep 10
- web shell 1 · Sep 10
- social engineering 1 · Aug 11
- execution 1 · Jul 20
- phishing 1 · Jul 17
attack phases seen
- Initial access 4 · Oct 25
- Impact 3 · Oct 25
- Persistence 3 · Oct 25
- Credential access 2 · Sep 10
- Collection 1 · Sep 10
- Discovery 1 · Sep 10
- Reconnaissance 1 · Aug 11
- Execution 1 · Jul 20
what we reported, newest first, grouped by story
Oct 23 – October 25, 2026 · 2 reports
- Sandworm and UAC-0099 teamed up for a destructive wiper attack on a Ukrainian logistics company, with UAC-0099 (aka Earth Sirrush) gaining initial access on July 16, 2025 via a spear-phishing attachment, per ESET. The intrusion involved a previously undocumented mesh-network backdoor. (The Hacker News)
· Oct 25 · observed · via phishing email · as uac 0099 · Threat Activity
- MythicRatatoskr hides its C2 inside the Yggdrasil mesh network. ESET documents a previously unreported Go backdoor used against a Ukrainian grain logistics firm: UAC-0099 gained initial access on July 16, 2025 and handed it to Sandworm, which ran a data-wiping attack on September 17, 2025. ESET
· Oct 23 · observed · as uac 0099 · Threat Activity
Jul 31 – September 10, 2026
- Cisco Secure Firewall Management Center: Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root) and CVE-2026-20316 (5.3, low-privileged login). Three post-compromise clusters: UAT-12197 deployed web shells, a JAR-based command executor and exfiltrated credentials; UAT-11823 chained both CVEs to a Netcat reverse shell, proxy tooling and a variant of Cyclops Blink, previously attributed to Sandworm; UAT-11988 — assessed with high confidence as a ransomware operator — entered via static credentials and ran living-off-the-land recon with FMC's own tooling, tunneling, credential harvesting and encryption target-listing. Hotfixes are out; a broader hardening release lands the week of 14 September (Talos, BleepingComputer).
· Sep 10 · observed · via exposed service · Exploited in the Wild
September 3, 2026
- Leaked Russian training materials map the pipeline from university recruitment to operational units including Sandworm — useful for understanding how consistent the tradecraft is across espionage, sabotage and influence tasking (Schneier on Security, SC World).
· Sep 3 · none · Threat Activity
August 11, 2026
- CERT-UA warns of Sandworm subcluster UAC-0145 running fake-job social engineering against Ukrainian sysadmins. Posing as an IT firm (e.g. "ATLAS Business Group") on job boards, the actor studies a candidate's résumé before making contact — attribution ties to APT44/Seashell Blizzard (CERT-UA).
· Aug 11 · attempted · via fake recruiter · as uac 0145, apt44 · Threat Activity
July 20, 2026
- UAC-0145 is using fake ClickFix CAPTCHAs to infect Ukrainian devices, tricking targets into pasting attacker commands to deliver malware (The Hacker News).
· Jul 20 · observed · via phishing email · as uac 0145 · Threat Activity
July 17, 2026
- Sandworm is using a fake-CAPTCHA lure against Ukrainian victims — instead of verifying they're human, users are instructed to paste a malicious PowerShell command into Windows (The Record).
· Jul 17 · attempted · via phishing email · Threat Activity