APT Spotlight: Sandworm

ReliaQuest’s blog examines the Russia-linked APT group Sandworm (aka Voodoo Bear/Telebots/Iron Viking), summarizing its ties to the GRU, history of destructive operations (NotPetya, BlackEnergy, Industroyer), and recent activity targeting Ukrainian critical infrastructure including Industroyer2, multiple disk wipers (CaddyWiper, ORCSHRED, SOLOSHRED, AWFULSHRED), and ransomware campaigns (RansomBoggs, Prestige). The report emphasizes Sandworm’s high sophistication and political motivation, the potential for significant physical and economic impact from ICS attacks during the Russia–Ukraine war, and recommends that organizations—especially those supporting or operating critical infrastructure—harden ICS defenses and prepare for continued disruptive activity.