What This Report Covers
This intelligence report profiles Sandworm, a Russian state-supported group described as GRU Unit 74455 and active since 2009. Its listed motivations are sabotage and espionage, and its methods include zero-days, malware and spearphishing.
The report sets out the group’s objectives, past cyberattacks, tactics, techniques and procedures, malware, open-source tools, indicators of compromise and YARA rules. It also lists the other names used for the group, such as Voodoo Bear and Iron Viking.
Targeted industries named are education, energy, government and telecommunications. Open summaries are in the Sandworm article and the Sandworm group profile.
Because it ties tactics to tools and indicators in one document, the report can feed rule-based security products as well as network and host based controls. It also supports awareness work on targeted attacks against critical sectors.
What You Will Find In This Report?
Learn Technical Method of Operation Details
The technical details of the Sandworm APT group and their abilities, infection methodologies, and more. The report will show many points about the group technical details, detections, and IoCs. See also the Industroyer, Olympic Destroyer and Infamous Chisel malware pages.
Gain Knowledge About Future Attacks
By understanding their attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. Sandworm has been increasingly active and sophisticated in recent years, making it more difficult for companies to protect themselves.