Nation-state APTEspionage
SandCat
SandCat is an Uzbekistan-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in Saudi Arabia.
- Origin
- Uzbekistan
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
Countries · 1
About SandCat.
One of the Windows vulnerabilities patched by Microsoft in December had been exploited by both FruityArmor and SandCat in attacks targeting the Middle East and Africa. The group has also used the CVE-2018-8589 and CVE-2018-8611 Windows vulnerabilities in its attacks, both of which had a zero-day status when Microsoft released fixes.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.