Sandworm (hacker group)

Last updated

Sandworm
Formationc. 2004–2007
Type Advanced persistent threat
Purpose Cyberespionage, cyberwarfare
Headquarters22 Kirova Street
Khimki, Russia
Region
Russia
Methods Zero-days, spearphishing, malware
Official language
Russian
Parent organization
 GRU
Affiliations Fancy Bear
Formerly called
Voodoo Bear [1]
Iron Viking [2]
Telebots [2]

Sandworm is an advanced persistent threat operated by Military Unit 74455, a cyberwarfare unit of the GRU, Russia's military intelligence service. [3] Other names for the group, given by cybersecurity researchers, include APT44, [4] Telebots, Voodoo Bear, IRIDIUM, Seashell Blizzard, [5] and Iron Viking. [6] [7] [8]

Contents

The team is believed to be behind the December 2015 Ukraine power grid cyberattack, [9] [10] [11] the 2017 cyberattacks on Ukraine using the NotPetya malware, [12] various interference efforts in the 2017 French presidential election, [6] and the cyberattack on the 2018 Winter Olympics opening ceremony. [13] [14] Then-United States Attorney for the Western District of Pennsylvania Scott Brady described the group's cyber campaign as "representing the most destructive and costly cyber-attacks in history." [6]

History

2014

On September 3, 2014 iSIGHT Partners (now Mandiant) discovered a spear-phishing campaign exploiting a zero-day vulnerability via weaponized Microsoft Office documents. The vulnerability, dubbed CVE-2014-4114, affected all versions of Windows from Vista to 8.1 and allowed attackers to execute arbitrary code on a target machine. Researchers were able to attribute the attack to the Sandworm group and observed that the Ukrainian government was one target of the campaign. Notably, this attack coincided with a NATO summit on Ukraine in Wales. [15]

2015 Ukraine power grid hack

On December 23, 2015, hackers launched a coordinated cyberattack against 3 energy companies in Ukraine and succeeded in temporarily disrupting the supply of electricity to about 230,000 Ukrainians for 1-6 hours.

In January, iSight Partners released a report linking the attack to Sandworm based on the usage of BlackEnergy 3. [16]

2016 Ukraine power grid hack

On December 17, 2016, a year after the previous power grid attack, hackers again disrupted the Ukrainian power grid with a cyber attack. About one fifth of Kyiv lost power for an hour. While the outage was ultimately short, a report released 3 years after the attack by security firm Dragos outlines a theory that the malware, known as Industroyer or CRASHOVERRIDE, was meant to destroy physical electrical equipment. By exploiting a known vulnerability in the protective relays, the malware may have been designed to obfuscate any safety issues such that when engineers worked to restore power, an overload of current would be sent to destroy transformers or power lines. Such destruction would have potentially harmed utility workers as well as led to a much longer power outage if it had succeeded. [17]

2018 Winter Olympics

On February 9, 2018 during the opening ceremony of the Winter Olympics in Pyeongchang, South Korea hackers launched a cyberattack and successfully disrupted IT infrastructure including WiFi, TVs around the Pyeongchang Olympic Stadium showing the ceremony, RFID-based security gates, and the official Olympics app which was used for digital ticketing. Staff were able to restore most critical functions before the opening ceremony was over, but the entire network had to be rebuilt from scratch. Wiper malware had wormed through every domain controller and rendered them inoperable. [13]

3 days later Cisco Talos published a report dubbing the malware "Olympic Destroyer". The report listed similarities in the malware's propagation techniques to the "BadRabbit" and "Nyetya" malware strains and stated disruption of the games as the attack's objective. [18]

Attribution of the Olympic Destroyer malware proved difficult as it appeared the author(s) had included code samples belonging to multiple threat actors as false flags. Intezer published a report on Feb 12 showing code similarities to samples attributed to 3 Chinese threat actors while a follow-up Talos report noted a "weak" clue pointing to another wiper created by a spinoff of the Lazarus Group, a North Korean APT. [19] [20]

The Kaspersky GReAT team on March 8 published 2 blog posts discussing the current industry theories and their own original research. In the technical article Kaspersky, a Russian company, showed in detail how they discovered file headers pointing to Lazarus Group were forged but stopped short of attributing the Olympic Destroyer malware to any non-North Korean group. [21] [22]

US Indictment (2020)

FBI wanted poster listing 6 Russian military officers indicted for cyber crimes. FBI GRU Sandworm Wanted Poster.pdf
FBI wanted poster listing 6 Russian military officers indicted for cyber crimes.

On 19 October 2020, a US-based grand jury released an indictment charging six alleged Unit 74455 officers with cybercrimes. [23] [24] [25] The officers, Yuriy Sergeyevich Andrienko, Sergey Vladimirovich Detistov, Pavel Valeryevich Frolov, Anatoliy Sergeyevich Kovalev, Artem Valeryevich Ochichenko, and Petr Nikolayevich Pliskin, were all individually charged with conspiracy to conduct computer fraud and abuse, conspiracy to commit wire fraud, wire fraud, damaging protected computers, and aggravated identity theft. Five of the six were accused of overtly developing hacking tools, while Ochichenko was accused of participating in spearphishing attacks against the 2018 Winter Olympics and conducting technical reconnaissance on and attempting to hack the official domain of the Parliament of Georgia. [6] [lower-alpha 1]

Concurrent with the US indictment announcement, the UK's National Cyber Security Centre (NCSC) published a report which publicly associated Sandworm with the 2018 Winter Olympics attack. [2]

Exim Exploitation (2020)

On May 28, 2020 the National Security Agency published a cybersecurity advisory warning that the Sandworm group was actively exploiting a remote code execution vulnerability (referred to as CVE-2019-10149) in Exim [32] to gain full control of mail servers. [33] At the time the advisory was published, an updated version of Exim had been available for a year and the NSA urged administrators to patch their mail servers.

In February 2022, Sandworm allegedly released the Cyclops Blink as malware. The malware is similar to VPNFilter. [34] The malware allows a botnet to be constructed, and affects Asus routers and WatchGuard Firebox and XTM appliances. CISA issued a warning about this malware. [35]

War Crimes Request (March 2022)

In late March 2022, human rights investigators and lawyers in the UC Berkeley School of Law sent a formal request to the Prosecutor of the International Criminal Court in The Hague. [36] They urged the International Criminal Court to consider war crimes charges against Russian hackers for cyberattacks against Ukraine. [36] Sandworm was specifically named in relation to December 2015 attacks on electrical utilities in western Ukraine and 2016 attacks on utilities in Kyiv in 2016. [36]

Ukrainian Power Grid Attack (April 2022)

In April 2022, Sandworm attempted a blackout in Ukraine. [37] It is said to be the first attack in five years to use an Industroyer malware variant called Industroyer2. [38]

SwiftSlicer (January 2023)

On 25 January 2023, ESET attributed an Active Directory vulnerability wiper to Sandworm. [39]

Infamous Chisel (August 2023)

On August 31, 2023, the cybersecurity agencies of the US, UK, Canada, Australia, and New Zealand (collectively known as Five Eyes) jointly published a report on a new malware campaign and attributed it to Sandworm. The malware, dubbed "Infamous Chisel", targeted Android devices used by the Ukrainian military. After initial infection, the malware establishes persistent access then periodically collects and exfiltrates data from the compromised device. Collected information includes:

The malware also periodically collects open ports and banners of services running on other hosts on the local network. Additionally, an SSH server is created and configured to run as a Tor hidden service. An attacker could then connect remotely to the infected device without revealing their true IP address. [40]

Name

The name "Sandworm" was dubbed by researchers at iSight Partners (now Mandiant) due to references in the malware source code to Frank Herbert's novel Dune. [41]

In 2024, given the active and persistent threats Sandworm posed to governments and critical infrastructure operators globally, Mandiant "graduated" Sandworm into an APT group, dubbing it APT44. [4]

See also

Notes

  1. ↑ The United States Department of State Diplomatic Security Service: Rewards for Justice is offering a reward of up to $10 million for information leading to the identification or location of the GRU officers Petr Nikolayevich Pliskin (Russian: Петр Николаевич Плискин), Artem Valeryevich Ochichenko (Russian: Артем Валерьевич Очиченко), Anatoliy Sergeyevich Kovalev (Russian: Анатолий Сергеевич Ковалев), Pavel Valeryevich Frolov (Russian: Павел Валерьевич Фролов), Sergey Vladimirovich Detistov (Russian: Сергей Владимирович Детистов) and Yuriy Sergeyevich Andrienko (Russian: Юрий Сергеевич Андриенко) of the Main Center for Technologies Special Forces of the GRU Russian Ground Forces (Unit 74455) which is associated with "Sandworm Team," Telebots," "Voodoo Bear," and "Iron Viking." [26] [27] [28] [29] [30] [31]

Related Research Articles

<span class="mw-page-title-main">Cyberwarfare</span> Use of digital attacks against a state

Cyberwarfare is the use of cyber attacks against an enemy state, causing comparable harm to actual warfare and/or disrupting vital computer systems. Some intended outcomes could be espionage, sabotage, propaganda, manipulation or economic warfare.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

Cyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of cyber-dissidents and other active measures. According to investigative journalist Andrei Soldatov, some of these activities were coordinated by the Russian signals intelligence, which was part of the FSB and formerly a part of the 16th KGB department. An analysis by the Defense Intelligence Agency in 2017 outlines Russia's view of "Information Countermeasures" or IPb as "strategically decisive and critically important to control its domestic populace and influence adversary states", dividing 'Information Countermeasures' into two categories of "Informational-Technical" and "Informational-Psychological" groups. The former encompasses network operations relating to defense, attack, and exploitation and the latter to "attempts to change people's behavior or beliefs in favor of Russian governmental objectives."

<span class="mw-page-title-main">Kaspersky Lab</span> Russian multinational cybersecurity and anti-virus provider

Kaspersky Lab is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, internet security, password management, endpoint security, and other cybersecurity products and services.

Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005. Stuxnet targets supervisory control and data acquisition (SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, multiple independent news organizations recognize Stuxnet to be a cyberweapon built jointly by the United States and Israel in a collaborative effort known as Operation Olympic Games. The program, started during the Bush administration, was rapidly expanded within the first months of Barack Obama's presidency.

In computer security, a wiper is a class of malware intended to erase the hard drive or other static memory of the computer it infects, maliciously deleting data and programs.

Operation Red October or Red October was a cyberespionage malware program discovered in October 2012 and uncovered in January 2013 by Russian firm Kaspersky Lab. The malware was reportedly operating worldwide for up to five years prior to discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices. The primary vectors used to install the malware were emails containing attached documents that exploited vulnerabilities in Microsoft Word and Excel. Later, a webpage was found that exploited a known vulnerability in the Java browser plugin. Red October was termed an advanced cyberespionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.

<span class="mw-page-title-main">Andy Greenberg</span> American technology journalist

Andy Greenberg is a technology journalist serving as a senior writer at Wired magazine. He previously worked as a staff writer at Forbes magazine and as a contributor for Forbes.com. He has published the books This Machine Kills Secrets concerning whistleblowing, Sandworm, concerning the eponymous hacking group, and Tracers in the Dark, concerning cryptocurrency tracing as a law enforcement investigative technique.

Cozy Bear is a Russian advanced persistent threat hacker group believed to be associated with Russian foreign intelligence by United States intelligence agencies and those of allied countries. Dutch signals intelligence (AIVD) and American intelligence had been monitoring the group since 2014 and was able to link the hacker group to the Russian foreign intelligence agency (SVR) after compromising security cameras in their office. CrowdStrike and Estonian intelligence reported a tentative link to the Russian domestic/foreign intelligence agency (FSB). Various groups designate it CozyCar, CozyDuke, Dark Halo, The Dukes, Midnight Blizzard, NOBELIUM, Office Monkeys, StellarParticle, UNC2452 with a tentative connection to Russian hacker group YTTRIUM. Symantec reported that Cozy Bear had been compromising diplomatic organizations and national governments since at least 2010. Der Spiegel published documents in 2023 purporting to link Russian IT firm NTC Vulkan to Cozy Bear operations.

Fancy Bear is a Russian cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. The UK's Foreign and Commonwealth Office as well as security firms SecureWorks, ThreatConnect, and Mandiant, have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as GRU Unit 26165. This refers to its unified Military Unit Number of the Russian army regiments. The headquarters of Fancy Bear and the entire military unit, which reportedly specializes in state-sponsored cyberattacks and decryption of hacked data, were targeted by Ukrainian drones on July 24, 2023, the rooftop on an adjacent building collapsed as a result of the explosion.

Lazarus Group is a hacker group made up of an unknown number of individuals, alleged to be run by the government of North Korea. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them since 2010. Originally a criminal group, the group has now been designated as an advanced persistent threat due to intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity organizations include Hidden Cobra and ZINC or Diamond Sleet. According to North Korean defector Kim Kuk-song, the unit is internally known in North Korea as 414 Liaison Office.

On December 23, 2015, the power grid in two western oblasts of Ukraine was hacked, which resulted in power outages for roughly 230,000 consumers in Ukraine for 1-6 hours. The attack took place during the ongoing Russo-Ukrainian War (2014-present) and is attributed to a Russian advanced persistent threat group known as "Sandworm". It is the first publicly acknowledged successful cyberattack on a power grid.

<span class="mw-page-title-main">Petya (malware family)</span> Family of encrypting ransomware discovered in 2016

Petya is a family of encrypting malware that was first discovered in 2016. The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.

<span class="mw-page-title-main">2017 Ukraine ransomware attacks</span> Series of powerful cyberattacks using the Petya malware

A series of powerful cyberattacks using the Petya malware began on 27 June 2017 that swamped websites of Ukrainian organizations, including banks, ministries, newspapers and electricity firms. Similar infections were reported in France, Germany, Italy, Poland, Russia, United Kingdom, the United States and Australia. ESET estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%. On 28 June 2017, the Ukrainian government stated that the attack was halted. On 30 June 2017, the Associated Press reported experts agreed that Petya was masquerading as ransomware, while it was actually designed to cause maximum damage, with Ukraine being the main target.

Industroyer is a malware framework considered to have been used in the cyberattack on Ukraine’s power grid on December 17, 2016. The attack cut a fifth of Kyiv, the capital, off power for one hour and is considered to have been a large-scale test. The Kyiv incident was the second cyberattack on Ukraine's power grid in two years. The first attack occurred on December 23, 2015. Industroyer is the first ever known malware specifically designed to attack electrical grids. At the same time, it is the fourth malware publicly revealed to target industrial control systems, after Stuxnet, Havex, and BlackEnergy.

Unit 29155 is a Russian military intelligence (GRU) unit associated with foreign assassinations and other activities apparently aimed at destabilizing European countries. The unit is thought to have operated in secret since at least 2008, though its existence only became publicly known in 2019.

Cisco Talos, or Cisco Talos Intelligence Group, is a cybersecurity technology and information security company based in Fulton, Maryland. It is a part of Cisco Systems Inc. Talos' threat intelligence powers Cisco Secure products and services, including malware detection and prevention systems. Talos provides Cisco customers and internet users with customizable defensive technologies and techniques through several of their own open-source products, including the Snort intrusion prevention system and ClamAV anti-virus engine.

<span class="mw-page-title-main">2022 Ukraine cyberattacks</span> Attack on Ukrainian government and websites

During the prelude to the Russian invasion of Ukraine and the Russian invasion of Ukraine, multiple cyberattacks against Ukraine were recorded, as well as some attacks on Russia. The first major cyberattack took place on 14 January 2022, and took down more than a dozen of Ukraine's government websites. According to Ukrainian officials, around 70 government websites, including the Ministry of Foreign Affairs, the Cabinet of Ministers, and the National and Defense Council (NSDC), were attacked. Most of the sites were restored within hours of the attack. On 15 February, another cyberattack took down multiple government and bank services.

Cyclops Blink is malicious Linux ELF executable, compiled for the 32-bit PowerPC architecture. It targeted routers and firewall devices from WatchGuard and ASUS and adds them to a botnet for command and control (C&C). The malware is reported to be originated from the hacker group Sandworm.

References

  1. ↑ Adam Meyers (29 January 2018). "VOODOO BEAR | Threat Actor Profile | CrowdStrike". Crowdstrike.
  2. 1 2 3 "UK exposes series of Russian cyber attacks against Olympic and Paralympic Games". National Cyber Security Centre. 19 October 2020.
  3. ↑ Greenberg, Andy (2019). Sandworm: a new era of cyberwar and the hunt for the Kremlin's most dangerous hackers. Knopf Doubleday. ISBN   978-0-385-54441-2.
  4. 1 2 "APT44: Unearthing Sandworm" (PDF). Retrieved 12 September 2024.
  5. ↑ "How Microsoft names threat actors". Microsoft. Retrieved 21 January 2024.
  6. 1 2 3 4 "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace". DOJ Office of Public Affairs. United States Department of Justice. 19 October 2020. Retrieved 23 July 2021.
  7. ↑ Timberg, Craig; Nakashima, Ellen; Munzinger, Hannes; Tanriverdi, Hakan (30 March 2023). "Secret trove offers rare look into Russian cyberwar ambitions". The Washington Post . Retrieved 31 March 2023.
  8. ↑ "Russia's FSB malign activity: factsheet: Cyber operations and the Russian intelligence services". National Cyber Security Centre (NCSC) and Foreign, Commonwealth and Development Office . 7 December 2023. Archived from the original on 8 December 2023. Retrieved 18 October 2024.
  9. ↑ "Hackers shut down Ukraine power grid". www.ft.com. 5 January 2016. Retrieved 28 October 2020.
  10. ↑ Volz, Dustin (25 February 2016). "U.S. government concludes cyber attack caused Ukraine power outage". Reuters. Retrieved 28 October 2020.
  11. ↑ Hern, Alex (7 January 2016). "Ukrainian blackout caused by hackers that attacked media company, researchers say". The Guardian. ISSN   0261-3077 . Retrieved 28 October 2020.
  12. ↑ "The Untold Story of NotPetya, the Most Devastating Cyberattack in History". Wired. ISSN   1059-1028 . Retrieved 28 October 2020.
  13. 1 2 Greenberg, Andy. "Inside Olympic Destroyer, the Most Deceptive Hack in History". Wired. ISSN   1059-1028 . Retrieved 28 October 2020.
  14. ↑ Andrew S. Bowen (24 November 2020). Russian Military Intelligence: Background and Issues for Congress (PDF) (Report). Congressional Research Service. p. 16. Retrieved 21 July 2021.
  15. ↑ Stephen Ward (14 October 2014). "iSIGHT discovers zero-day vulnerability CVE-2014-4114 used in Russian cyber-espionage campaign". Archived from the original on 14 October 2014. Retrieved 5 November 2023.
  16. ↑ Hultquist, John (7 January 2016). "Sandworm Team and the Ukrainian Power Authority Attacks". iSIGHT Partners. Archived from the original on 29 January 2016.
  17. ↑ Joe Slowik (15 August 2019). "CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack" (PDF). Dragos Inc.
  18. ↑ Warren Mercer (12 February 2018). "Olympic Destroyer Takes Aim At Winter Olympics". Cisco Talos.
  19. ↑ Rascagneres, Paul; Lee, Martin (26 February 2018). "Who Wasn't Responsible for Olympic Destroyer?". Cisco Talos.
  20. ↑ Jay Rosenberg (12 February 2018). "2018 Winter Cyber Olympics: Code Similarities with Cyber Attacks in Pyeongchang". Archived from the original on 30 June 2020.
  21. ↑ Kaspersky GReAT Team (8 March 2018). "OlympicDestroyer is here to trick the industry". Archived from the original on 31 January 2019.
  22. ↑ Kaspersky GReAT Team (8 March 2018). "The devil's in the Rich header". Archived from the original on 22 February 2019.
  23. ↑ Cimpanu, Catalin. "US charges Russian hackers behind NotPetya, KillDisk, OlympicDestroyer attacks". ZDNet. Retrieved 28 October 2020.
  24. ↑ "Russian cyber-attack spree shows what unrestrained internet warfare looks like". The Guardian. 19 October 2020. Retrieved 28 October 2020.
  25. ↑ "US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit". Wired. ISSN   1059-1028 . Retrieved 28 October 2020.
  26. ↑ "Petr Nikolayevich Pliskin". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  27. ↑ "Artem Valeryevich Ochichenko". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  28. ↑ "Anatoliy Sergeyevich Kovalev". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  29. ↑ "Pavel Valeryevich Frolov". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  30. ↑ "Sergey Vladimirovich Detistov". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  31. ↑ "Yuriy Sergeyevich Andrienko". United States Department of State Diplomatic Security Service: Rewards for Justice . Archived from the original on 9 October 2024. Retrieved 9 October 2024.
  32. ↑ Satnam Narang (6 June 2019). "CVE-2019-10149: Critical Remote Command Execution Vulnerability Discovered In Exim" . Retrieved 4 November 2023.
  33. ↑ "Exim Mail Transfer Agent Actively Exploited by Russian GRU Cyber Actors". National Security Agency. Archived from the original on 24 March 2023.
  34. ↑ Hardcastle, Jessica Lyons. "Cyclops Blink malware sets up shop in ASUS routers". www.theregister.com. Retrieved 21 March 2022.
  35. ↑ "CISA Adds Eight Known Exploited Vulnerabilities to Catalog | CISA". www.cisa.gov. 11 April 2022. Retrieved 13 April 2022.
  36. 1 2 3 Greenberg, Andy (12 May 2022). "The Case for War Crimes Charges Against Russia's Sandworm Hackers". Wired . Retrieved 7 July 2022.
  37. ↑ Greenberg, Andy. "Russia's Sandworm Hackers Attempted a Third Blackout in Ukraine". Wired. ISSN   1059-1028 . Retrieved 13 April 2022.
  38. ↑ "Industroyer2: Industroyer reloaded". www.welivesecurity.com. Retrieved 13 April 2022.
  39. ↑ Živé.sk (27 January 2023). "Na Ukrajine maže počítače nový trójsky kôň. Hackeri majú byť prepojení na Rusko". Živé.sk (in Slovak). Retrieved 27 January 2023.
  40. ↑ "Infamous Chisel Malware Analysis Report". Cybersecurity & Infrastructure Security Agency. 31 August 2023. Retrieved 6 November 2023.
  41. ↑ Kim Zetter (14 October 2014). "Russian 'Sandworm' Hack Has Been Spying on Foreign Governments for Years". Wired. Archived from the original on 14 October 2014.

Further reading

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.