Incidents
Sandworm
Review stories that name this actor, with reporting mentions kept distinct from attribution of an operation.
News reporting onlyThis profile is assembled only from stories in this tracker’s reporting corpus. A mention measures this tracker’s coverage and is not attribution of an operation.
Named in 17 stories by this tracker. Population: 256 news stories with stored actor tags in this tracker corpus.
Stories that name this actor
- 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
- Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
- GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
- Leaked Russian Cyber-Operations Training Materials
- Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
- Risky Bulletin: Russian hackers adopt the fake job interview tactics
- Sandworm hackers target IT pros with trojanized WireGuard VPN client
- Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
- Russian military hackers pose as recruiters to target Ukrainian IT workers
- Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
- Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
- Google’s solution to hacker name confusion? Yet another naming system
- UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware
- Now, even Russia's most elite hackers are using Clickfix to infect devices
- Sandworm hackers have a CAPTCHA trick for Ukrainians
- ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025
- Russia-Linked Threats to Operational Technology