Sandworm

Summary

GRU Main Center for Special Technologies (GTsST), military unit 74455 — Mandiant's APT44, Microsoft's Seashell Blizzard; the most destructive state cyber unit on record. Newest activity: a Dec 2025–Mar 2026 wiper wave against Ukraine deployed through Active Directory Group Policy — RansomTuga disguised as ransomware at a grain firm, the Rust wiper ZeroRays (CERT-UA: ZEROSETH), NAUGHTYWIPE and NikoWiper variants (ESET); ZOV wiper against a Ukrainian financial institution (Nov 2025, high confidence); DynoWiper at a Polish energy company (Dec 2025, ESET medium confidence — rare destructive targeting of a NATO member's critical infrastructure). 2025: ZEROLOT and Sting against Ukrainian university, government, energy, logistics and grain organisations, with access handed over by UAC-0099 (ESET). BadPilot, an initial-access subgroup, exploited ScreenConnect, FortiClient EMS, Openfire, Zimbra and other edge flaws worldwide (2021–2024, Microsoft); Amazon assesses a long-running edge-device credential-harvesting cluster as Sandworm (assessed). History: Ukrainian grid attacks (2015, 2016, 2022), NotPetya (2017), Industroyer2 + CaddyWiper (Apr 2022), Kyivstar (2023); Viasat/AcidRain (Feb 2022) is linked only at medium confidence.

Attribution

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• US Department of Justice (Government, 2020-10-19)
  Indictment of six GRU Unit 74455 officers (NotPetya, Ukrainian grid, Olympic Destroyer)
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Attributed to GRU Main Center for Special Technologies, unit 74455

MITRE ATT&CK techniques 8

Exploited vulnerabilities 7

Highest CVSS first.

Infrastructure patterns

• Wipers pushed through Active Directory Group Policy after domain-admin compromise (ESET, 2025–2026)
• Initial access sometimes bought in from other clusters — UAC-0099 handed validated targets to Sandworm (ESET, 2025)