Threat actor
Sandworm
Tracked by CyberSIXT since Jul 9, 2026 · last activity Aug 12, 2026
Linked incidents
Coverage timeline
-
Sandworm hits Polish power plant via private APN, brief outagewww.infosecurity-magazine.com · Aug 12, 2026
-
Sandworm Group Uses Fake Job VPN to Hijack Devicesthehackernews.com · Aug 11, 2026
-
Poland’s grid hit again by Sandworm via Fortinet VPNwww.securityweek.com · Aug 10, 2026
-
Google introduces two word names for threat actors renaming APT44www.securityweek.com · Jul 28, 2026
-
Sandworm uses CAPTCHAs to deliver FreakyPoll malware in Ukrainearstechnica.com · Jul 16, 2026
-
Ukrainian Tax Firm Hit by Sandworm Warns Global Businesseswww.darkreading.com · Jul 9, 2026