Threat actor
Sandworm
Tracked by CyberSIXT since 9 Jul · last activity 23 Oct
- CVEs linked · all time
- 2
- in CISA KEV · all time
- 2
- articles · all time
- 8
2 articles since 11 Sep.
Show as table
| Day (UTC) | Articles |
|---|---|
| Mon 14 Sep | 1 |
| Fri 23 Oct | 1 |
CVEs
2 CVEsCVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVSS10.0CriticalExploited88%EPSS14articles
CVE-2026-20316Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityCVSS5.3MediumExploited35%EPSS10articles
- Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper AttackThe Hacker News
- Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops BlinkDark Reading
- Sandworm hits Polish power plant via private APN, brief outageInfosecurity
- Sandworm Group Uses Fake Job VPN to Hijack DevicesThe Hacker News
- Poland’s grid hit again by Sandworm via Fortinet VPNSecurityWeek
- Google introduces two word names for threat actors renaming APT44SecurityWeek
- Sandworm uses CAPTCHAs to deliver FreakyPoll malware in UkraineArs Technica
- Ukrainian Tax Firm Hit by Sandworm Warns Global BusinessesDark Reading · first in our coverage