The Demon Sandworm, the Worm of the Sands

Technical record

Also known as

Sandworm, GRU Unit 74455, Voodoo Bear, IRIDIUM, Seashell Blizzard, ELECTRUM, APT44

Circle

Circle V · State espionage · Circle IV · Destroyers (wipers)

First seen

c. 2009

Status

Active

Weapons (exploited CVEs)

Saint Sandworm, the Worm of the Sands · Saint The Return of the WIZard

A destructive threat group attributed to Russia's GRU Unit 74455, active since at least 2009. It is responsible for the first blackouts caused by cyberattacks in Ukraine, NotPetya and Olympic Destroyer. Six of its officers were indicted by the US in 2020.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference G0034

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.