D
CyberRussia

Sandworm Team

State-sponsored cyber threat groupActivePending verification

Also known as: APT44, Seashell Blizzard, Voodoo Bear, IRON VIKING

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsAPT44, Seashell Blizzard, Voodoo Bear, IRON VIKING
ProliferationOrigin country only
Active since2009Med[1]
MITRE ATT&CK IDG0034High[1]
Attribution and activity
Attributed sponsorGRU GTsST, military unit 74455Med[1]
TargetsElectric power, government, transportation and logistics (Ukraine, Georgia, Poland)Med[1]
Notable activityUkraine power attacks (2015, 2016, 2022); NotPetya (2017); Olympic Destroyer (2018)Med[1]
Summary

Destructive cyber threat group attributed to Russia's GRU Main Center for Special Technologies (GTsST), military unit 74455.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. Sandworm Team, Group G0034, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-10-03
Change log
  • 2026-10-03 Initial draft entry from cited open sources
  • 2026-10-03 Added identification art