Sandworm (APT44): Russia’s Most Destructive Cyber Weapon

Sandworm, also tracked as APT44, is a Russian state-backed hacking group. MITRE ATT&CK ties it to the GRU Main Center for Special Technologies, military unit 74455. CISA says that unit has operated since at least 2009. The post links the group to destructive attacks. These include NotPetya in 2017 and attacks on Ukrainian power grids.

Introduction

Few cyber actors mix cyber sabotage, espionage, and military strategy like Sandworm. It is also known as APT44, VOODOO BEAR, and IRON VIKING. It is considered with high confidence to have worked for Russia’s GRU (Main Directorate of the General Staff) for over a decade. Sandworm is behind some of the most consequential cyberattacks ever conducted.

This group has stirred strong opinions. People link it to the destruction of Ukrainian power grids. They also hold it responsible for NotPetya, one of the most costly cyber incidents to date. By 2025, the group had changed how it operates. It added several new wiper families, such as AcidPour. It also widened its campaigns against critical infrastructure worldwide. The Brandefense Knowledge Hub also has the Industroyer, Olympic Destroyer and AcidRain malware pages.

Who Is Sandworm and What Motivates It?

Sandworm also goes by many other names, such as FROZENBARENTS, Seashell Blizzard, ELECTRUM, TeleBots, TEMP.Noble, IRIDIUM, Blue Echidna, etc. Whatever the name, the actor is in the end described as a GRU-controlled cyber unit.

• Active Since: Approximately 2009, with public awareness from the mid-2010s.
• Motivation: Strategic disruption and espionage in the interests of Russian geopolitical goals. Its campaigns often match a major military or political event. This clearly shows its role as a tool of the state.
• Category: State-sponsored Advanced Persistent Threat (APT).

Unlike ransomware groups that want money, Sandworm acts on geopolitical and military goals. Collateral damage is often seen as acceptable, or even intended.

TTPs (Tactics, Techniques and Procedures)

Initial Access

Sandworm remains skilled at exploiting internet-facing vulnerabilities and zero-days. It does this mostly in these areas:

• VPN appliances and remote access tools.
• Industrial Control Systems (ICS) and SCADA software.
• Edge devices and administrative panels.

They also use spear-fishing campaigns that pose as government mail. They use supply-chain compromises too.

Persistence and Privilege Escalation

The group deploys custom backdoors to keep access for a long time. It usually gains higher privileges in these ways:

• Credential dumping (using stolen service accounts).
• Exploiting Active Directory.
• Abuse of Kerberos tickets.

Command and Control

Sandworm runs its C2 over several channels:

• HTTP/S and domain fronting.
• Compromised infrastructure to obfuscate origins.
• Use of non-standard protocols for discreet exfiltration.

Malware and Tools

Its toolkit holds some of the most notorious malware families ever used:

• BlackEnergy: An early backdoor/wiper used in the Ukrainian power outages.
• NotPetya: A destructive wiper disguised as ransomware that caused billions of dollars in damages around the world.
• Industroyer / CrashOverride: CS-specific malware designed to disrupt electric substations.
• Olympic Destroyer: Malware preying on systems used for the Winter Olympics.
• AcidRain / AcidPour: Recent wiper families that can brick modems, servers, telecom equipment, and exfiltrate data.

Together, these tools show that Sandworm can both spy and destroy.

Techniques in Post-Compromise

Lateral Movement: PsExec, stolen credentials, remote management tools.

Reconnaissance: Targeting ICS/OT environment to deliver maximum impact.

Data Exfiltration + Destruction: Stealing sensitive data, then using wipers to block recovery of the infrastructure.

Who Does Sandworm Target?

Sandworm’s victims match the military and political interests of Russia:

• Sectors: Energy (power grids, electricity), telecommunications, defense, finance, government agencies, media outlets, and transportation.
• Geographies: Ukraine is the main place where Sandworm operates. NATO countries and European allies are common secondary targets. Sandworm operations in general have also caused collateral damage across the globe (including the U.S. and multinational corporations).

The organization’s aims for action are:

1. Ruin critical infrastructure in enemy states.

2. Disrupt military operations on behalf of Russia.
3. Undermine public belief in Western institutions by creating chaos and outages.

Notable Operations

Ukraine Power Grid Attacks (2015–2016)

Sandworm used BlackEnergy malware to disrupt the SCADA systems in Ukraine. This caused power outages that left hundreds of thousands of people without power. These were the first confirmed blackouts from a cyber attack.

NotPetya (2017)

Called ransomware, the attack was really a form of wiper malware. It spread fast through compromised Ukrainian tax software. It hit businesses across the world hard, including well known ones like Maersk, FedEx, and Merck. The attack caused more than $10 billion in damages. It was one of the most costly cyber attacks in history.

Industroyer / CrashOverride (2017–2018)

Industroyer was built to work with industrial protocols. It targeted electrical substations in Ukraine. This showed Sandworm’s experience with malware that targets Industrial Control Systems (ICS).

Olympic Destroyer (2018)

During the Winter Olympics in PyeongChang, South Korea, Sandworm disrupted IT infrastructure. It disabled Wi-Fi, ticketing, and broadcasting operations. The disruption showed that Sandworm can run cyber-attacks that lead to global, high-profile disruption.

Ukraine War Campaigns (2022–2023)

As the Russian invasion of Ukraine unfolded, Sandworm launched several disruptive campaigns. They hit Ukrainian government entities, telecommunication providers, and energy entities. These campaigns often came at the same time as kinetic military campaigns.  

AcidRain & AcidPour (2024–2025)

Sandworm built newer wiper families, including AcidPour. They do not only wipe data. They also exfiltrate sensitive military and telecommunication information. AcidPour was mainly used against Ukrainian ISPs and critical communications infrastructure. The aim was to disrupt and cut command and control over adversary military engagements.

Evolution and Recent Developments

Sandworm has moved from a conventional operation focused on espionage to a wide, destructive one. Signs of this shift include:

• Integration with kinetic warfare: Cyber operations were lined up with Russian military operations.
• Focus on OT/ICS disruption: The malware is increasingly sophisticated and was built on purpose to take down industrial infrastructure.
• New wiper generations: AcidPour shows a move to data theft combined with destruction.
• Global collateral: Sandworm is willing to cause disruption in countries outside Ukraine, as NotPetya showed.

As of 2025, Sandworm is most likely the most destructive state-backed APT in history.

Conclusion

The cyber-attack skills of Sandworm are the peak of state-sponsored destructive hacking. A typical APT focuses on espionage. Sandworm stands out for its ability to sabotage at scale. Its campaigns show that cyber tools can do far more than spy on targets. They can disrupt and incapacitate nations and economies. They can also be a strategic extension of force in warfare.

For defenders, the key lessons are:

• Critical Infrastructure Defense: Make sure IT and OT environments are properly segmented.
• Patch Management: Find ways to stay ahead of zero-day exploitation. Keep an eye on edge devices and VPNs.
• Incident Readiness: Always keep offline backups and tested recovery plans.
• Threat Hunting: Watch for living-off-the-land behaviors and shifts in ICS traffic patterns.

As geopolitical tensions between Russia and the West rise, Sandworm’s operations will stay at the core of global risk and uncertainty. Sandworm is not just another APT. It is a cyberweapon. The Russian state uses Sandworm in hybrid warfare, with devastating implications.

You can download and review the sheet for all the details!