Tag: sandworm

3 Attack Reports | 0 Vulnerabilities

Attack reports

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites …
apt
sandworm
wiper
2025-06-05
pathwiper
Published: June 5, 2025
Downloadable IOCs: 1

Targeted activity UAC-0212 against developers and suppliers of automation and process control solutions

In 2024-2025, UAC-0212, a subcluster of UAC-0002 (Sandworm), launched targeted cyberattacks against Ukrainian critical infrastructure and related industries. The actor employed new tactics, exploiting CVE-2024-38213 to deliver malware through PDF documents. Tools like SECONDBEST, EMPIREPAST, SPARK,…
sandworm
supply chain
CVE-2024-38213
2025-02-26
crookbag
Published: February 26, 2025
Linked vulnerabilities : CVE-2024-38213 (CVSS 6.5)
Downloadable IOCs: 112

Cyberattack: UAC-0125 using the theme "Army+" (CERT-UA#12559)

A cyber attack attributed to UAC-0125 has been identified, involving websites mimicking the official 'Army+' app page. These sites, hosted on Cloudflare Workers, prompt users to download a malicious executable. The EXE file, an NSIS installer, contains a decoy .NET file, Python interpreter, Tor fil…
sandworm
openssh
cloudflare workers
nsis
tor
2024-12-20
apt44
uac-0125
army+
Published: December 20, 2024
Downloadable IOCs: 6
Click here to see more Attack Reports