Sandworm
A Russian military intelligence unit that the UK government links to GRU Unit 74455 and describes as specialising in destructive cyber operations. It is best known for attacks on Ukraine's power grid and for NotPetya. ESET reported new wiper attacks in Ukraine over the winter of 2025 to 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The UK government describes Unit 74455 as a highly sophisticated, longstanding actor that specialises in destructive operations and mainly targets critical national infrastructure, industrial control systems and Ukrainian military and government entities. It says the unit, alongside Unit 26165, attempted intrusions against the Foreign, Commonwealth and Development Office in March 2018 and against Dstl in April 2018, as part of efforts to disrupt investigations into the attempted murder of Yulia and Sergei Skripal.3
The effects can spread well beyond the first target. The UK attributes NotPetya to this unit and says it caused wide collateral damage to the global economy.3 Microsoft reported that an initial access subgroup it links to Seashell Blizzard focused on the US, Canada, Australia and the UK during 2024, and that some of its victims had little apparent strategic value, which suggests opportunistic targeting.6
Attribution is not settled for every recent attack. For the 29 December 2025 attack on Polish energy sites, ESET attributes the wiper to Sandworm with medium confidence and Dragos attributes the activity to ELECTRUM with moderate confidence.8,9 CERT Polska instead links the infrastructure to a different cluster, tracked as Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly, which press reports describe as FSB-linked.10,11 ESET says it attributes only the data-wiping component and cannot see the initial access, so other groups may have been involved.12
Few UK organisations are likely to be a chosen target, but opportunistic access and collateral damage do not depend on being chosen. Recovery from a wiper is therefore worth rehearsing, as well as prevention.
How It Attacks
This combines UK government, Microsoft, Amazon and ESET reporting.3,6,7,8 It shows behaviour across different operations, not one fixed attack.
- 1
Find Exposed Systems
Exploits internet-facing servers and products. Amazon also reports a GRU-linked cluster, overlapping with Sandworm infrastructure, using misconfigured edge devices with exposed management interfaces.
- 2
Harvest Credentials
Adds rogue JavaScript to Outlook Web Access sign-in pages, and dumps credentials from memory. Amazon reports stolen credentials being replayed against online services.
- 3
Hide in Normal Tools
Installs legitimate remote management agents such as Atera and Splashtop. Some hosts were also given a hidden Tor route for inbound access.
- 4
Collect Data
Has used tools such as rclone to send data out.
- 5
Destroy or Disrupt
Deploys wipers against IT systems, and has targeted electricity grids. In Poland, CERT Polska reports damaged remote terminal units at wind and solar sites, although electricity production continued.
Key Techniques
Selected from the group's ATT&CK v20 entry.1 ATT&CK lists many more, and a technique can sit under more than one tactic.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits public-facing applications for initial access and infrastructure. |
| T1584.005 | Botnet | Resource Development | Has used a large botnet to target small office and home network devices. |
| T1195.002 | Compromise Software Supply Chain | Initial Access | Distributed NotPetya through compromised Ukrainian accounting software. |
| T1505.003 | Web Shell | Persistence | Uses web shells to maintain access to victim networks. |
| T1219 | Remote Access Tools | Command and Control | Uses remote administration tools to carry out actions. |
| T1003.001 | LSASS Memory | Credential Access | Dumps Windows credentials from system memory. |
| T1485 | Data Destruction | Impact | Overwrites files using wipers such as CaddyWiper and KillDisk. |
| T1561.002 | Disk Structure Wipe | Impact | Has corrupted the master boot record on infected systems. |
| T1486 | Data Encrypted for Impact | Impact | Used Prestige ransomware against transport and logistics organisations. |
Tools Observed
Destructive and Grid-Focused Malware
Implants and Device Malware
Dual-Use Tools
These come from ATT&CK, the NCSC and Microsoft.1,4,6 ESET also attributes DynoWiper to Sandworm with medium confidence, and it is not listed above as settled.8 Some dual-use tools have legitimate uses, so finding one does not prove compromise.
Vulnerabilities
Microsoft ties these CVEs to the BadPilot subgroup, which it assesses is linked to Seashell Blizzard.6 CVE-2014-4114 comes from ATT&CK.1 Other actors have used several of these too, so one of them alone does not point to this group.
Amazon reports the GRU-linked cluster it tracks moving away from exploits and towards misconfigured edge devices, so patching alone will not close this route.7
Key Events
Active from at least this year, according to ATT&CK.1
BlackEnergy and Industroyer attacks disrupt Ukraine's electricity supply. The UK attributes both to Unit 74455.3
NotPetya hits Ukraine and causes wide collateral damage. The UK attributes it to Unit 74455 in 2018.3
Olympic Destroyer disrupts the PyeongChang Winter Olympics. Attempted intrusions target the FCDO and Dstl.3
The NCSC and US agencies expose Cyclops Blink, mainly deployed to WatchGuard devices.14,15
The NCSC and allies expose Infamous Chisel, used against Android devices of Ukrainian military personnel.4
Ukraine's SBU names Unit 74455 for the attack on telecoms provider Kyivstar, as the UK's profile records.3
Microsoft reports the multi-year BadPilot access operation.6
Attack on Polish energy sites, with attribution disputed between CERT Polska, ESET and Dragos. Heat and electricity supply continue.10,8,9
ESET reports increased destructive activity and several new wipers in Ukraine.5
Warning Signs
Drawn from Microsoft and Amazon reporting.6,7 None of these proves an attack alone, but each deserves a quick check.
- Remote management agents you did not approve, such as Atera or Splashtop
- Unexpected JavaScript changes on Outlook Web Access sign-in pages
- A new OpenSSH service or Tor configuration on a server
- Renamed ProcDump or other signs of LSASS dumping
- Unexpected packet capture files or utilities on edge devices
- Logins to online services using credentials also held on an edge device
- Admin portal sessions on routers or appliances from unexpected addresses
Defences That Matter
Shrink the Edge
- Audit edge devices and take management interfaces off the internet.15,7
- Segment management interfaces, remove default credentials and enforce MFA.7
- Remove plaintext protocols such as Telnet, HTTP and unencrypted SNMP.7
Patch What Is Exposed
- Prioritise the internet-facing products listed above.6
- Treat any password held on a compromised device as compromised, and replace it.15
Detect Quiet Access
- Use application control to block unauthorised remote management and reconnaissance tools.6
- Run EDR in block mode and require phishing-resistant MFA.6
- Review logs for credential reuse between devices and online services.7
Rehearse Wiper Recovery
- Keep offline backups, and test restoring whole environments.
- Segment OT from IT, with emergency plans for operating in isolation.16
Could You Rebuild After a Wiper Attack?
We can test your recovery plans and exposed systems against the methods in this profile, then help you close the gaps.
Sources
- MITRE ATT&CK: Sandworm Team (G0034), ATT&CK v20
- Mandiant (Google Cloud): APT44: Unearthing Sandworm, 17 April 2024
- UK Government: Profile of GRU cyber and hybrid threat operations, undated PDF with references up to 2025
- NCSC: UK and allies support Ukraine by calling out Russian GRU malware campaign, 31 August 2023
- ESET: APT Activity Report Q4 2025 to Q1 2026, 28 May 2026
- Microsoft Threat Intelligence: The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation, 12 February 2025
- Amazon Threat Intelligence: identifies Russian cyber threat group targeting Western critical infrastructure, 15 December 2025, updated 23 December 2025
- ESET: Russian Sandworm group attacks energy company in Poland with DynoWiper, 30 January 2026
- Dragos: ELECTRUM targeting Poland's electric sector, undated report page on the 29 December 2025 attack
- CERT Polska: Incident report on the energy sector, 30 January 2026
- Ukrainska Pravda: Poland believes Russian intelligence hackers were behind cyberattacks on country's energy facilities, 31 January 2026
- Dark Reading: Sandworm blamed for wiper attack on Polish power grid, 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- NCSC: New Sandworm malware Cyclops Blink replaces VPNFilter, 23 February 2022
- NCSC-UK, CISA, FBI and NSA: alert AA22-054A, New Sandworm Malware Cyclops Blink Replaces VPNFilter, 23 February 2022
- The Record: CISA initiative aims for critical infrastructure to operate during cyberattacks, 6 May 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.