As a reminder, Sandworm is one of the cybercrime groups that has been around for the past couple of years, and they have been delivering a wide range of different malware strains ever since. The most notable of these is, for example, the well-known binary called BlackEnergy, but the group managed to deal quite a lot of damage by using a variety of other tools as well.
Notable among these is their KillDisk tool, as well as Industroyer, back in 2016, that managed to disrupt the energy grid of Ukraine. As of today, the group is still active, although its operations were significantly disrupted only about three months following this event. Known targets of Sandworm’s massive cyber espionage campaign include governments, enterprises, and the private sector in general. So far, the discovery of their entire malware arsenal does not include any new tools, but only variants of previously known ones.
But, one of these previously known tools has been observed being used to cripple an airport in Ukraine, for example. Similarly, Russia, but Russia’s Federal Security Service (FSB) has allegedly also been seen using some of Sandworm’s tools itself. Not all of Sandworm’s activities include straightforward cybercrime, and thanks to the list of targets, we can see why.
According to the ESET report, the list of the group’s targets includes among others, military and energy-related entities, as well as governments in Europe and the US. However, companies in the Middle East, such as petrochemical companies have also become known to be interested in Sandworm. In any case, it appears that Sandworm’s operations do not focus solely on monetary gain, which is something worth noting.
However, that does not mean that it is not doing anything illegal. In fact, it is believed that Sandworm’s operations are significant, and it was even behind the damaging and cyber attacks that, in which Ukraine found itself in the center. According to the Operation Armageddon report, the group engaged in a cyberwar against the country in December 2015.
Post too long. Click here to view the full text.