Skip to content
Threat Feed
Subscribe

Actor

Sandworm

2 briefs RSS
Also known as: BlackEnergy Voodoo Bear Seashell Blizzard IRIDIUM
critical threat

UAC-0099 and Sandworm collaboration: MythicRatatoskr backdoor and destructive wiping

UAC-0099 gained initial access to a Ukrainian organization via spearphishing to deploy the MythicRatatoskr backdoor, which uses the Yggdrasil mesh network for C2, before handing off access to Sandworm for destructive data-wiping.

Sandworm +4 backdoor wiper uac-0099 yggdrasil
5t 2i
high threat

Sandworm Targeted Polish Energy Facility via Private APN Pivot

In December 2025, the threat actor Sandworm exploited an internet-facing firewall and a misconfigured cellular router to pivot through a private APN into a Polish energy facility's OT network, resulting in industrial sabotage.

VPN and firewall +5 Sandworm +4
6t