Skip to content

CyberSIXT Search

Threat actor · coverage timeline

Sandworm

8 articles from 5 outlets between 9 Jul and 23 Oct. First reported by Dark Reading.

Articles: 8; all time · from 5 outlets
Days with coverage: 8; across 107 days
Busiest day: 1; no day with more than one
Last 7 days: 0.1a day; vs 0.1 a day before
First report: 9 Jul; Dark Reading
CVEs named: 2; 2 in CISA KEV · in these articles

Coverage over time

8 articles · 9 Jul – 23 Oct

9 JulFirst report9 Jul · Dark Reading

Show as table

Sandworm: articles per day
Day (UTC)	Articles	Outlets
Thu 9 Jul	1	Dark Reading 1
Thu 16 Jul	1	Ars Technica 1
Tue 28 Jul	1	SecurityWeek 1
Mon 10 Aug	1	SecurityWeek 1
Tue 11 Aug	1	The Hacker News 1
Wed 12 Aug	1	Infosecurity 1
Mon 14 Sep	1	Dark Reading 1
Fri 23 Oct	1	The Hacker News 1

Articles

8 articles

Fri 23 Oct1 article

12:00
Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper AttackThe Hacker News

Mon 14 Sep1 article

22:16
Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops BlinkDark Reading

Wed 12 Aug1 article

09:51
Sandworm hits Polish power plant via private APN, brief outageInfosecurity

Tue 11 Aug1 article

18:57
Sandworm Group Uses Fake Job VPN to Hijack DevicesThe Hacker News

Mon 10 Aug1 article

10:17
Poland’s grid hit again by Sandworm via Fortinet VPNSecurityWeek

Tue 28 Jul1 article

09:01
Google introduces two word names for threat actors renaming APT44SecurityWeek

Thu 16 Jul1 article

19:46
Sandworm uses CAPTCHAs to deliver FreakyPoll malware in UkraineArs Technica

Thu 9 Jul1 article

15:07
Ukrainian Tax Firm Hit by Sandworm Warns Global BusinessesDark Reading · first report