UnclassifiedIdeologyAdvanced sophistication
Sandworm
Sandworm is a Russia-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 59 countries, including the United States and the United Kingdom. It uses 215 MITRE ATT&CK techniques and exploits 36 known CVEs.
Also known as
- Russia-linked APT
- APT44
- Sandworm (APT44)
- Sandworm APT
- GRU Unit 74455
- Origin
- Russia
- Techniques
- 215
- Exploited CVEs
- 36
- First seen
- Apr 7, 2022
- Last seen
- Dec 17, 2025
- Record updated
Who They Target.
Sectors · 17
Countries · 59
About Sandworm.
Russian state-aligned group known for cyber operations, previously attributed to similar QR code pairing techniques for account hijacking.
Last updated Oct 8, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.