Russia’s GRU hackers targeting misconfigured network edge devices in attacks on energy sector, Amazon says

Amazon security researchers attribute a 2021–2025 campaign to GRU-linked APT44 (Sandworm) that moved from exploiting software vulnerabilities to targeting misconfigured customer network edge devices hosted on AWS; attackers harvested credentials and established persistent access to hit Western energy, electric utility, MSSP, telecom and technology organizations, with more than ten victims identified.