Sandworm probably wasn’t behind Danish critical infrastructure cyberattack, report says

Forescout’s analysis of November 2023 attacks against Danish energy companies concludes that two waves — one exploiting a Zyxel firewall vulnerability and another using Mirai-related infrastructure — were likely unrelated and not the work of Sandworm; instead they appear to involve opportunistic IoT botnet activity (Cyclops Blink / Katana Mirai) and unpatched devices, affecting about 22 organizations and complicating attribution and incident response.