Sandworm Hackers Shift From IT Breaches to Critical OT Targets

Researchers observed a surge of Sandworm (Russia-linked GRU Unit 74455) activity between July 2025 and January 2026 across 10 industrial organizations in seven countries, identifying 29 confirmed incidents in a dataset of 5.5M alerts. The group leveraged living-off-the-land techniques, pre-existing compromises (Cobalt Strike, Metasploit), and legacy exploit chains (EternalBlue, DoublePulsar, WannaCry) to move from IT into OT/ICS assets—targeting HMIs, engineering workstations, PLCs and RTUs—with long warning windows (average 43 days) before escalation, indicating high risk of physical disruption to critical infrastructure.