UAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
- Mentions · 7d0
- Mentions · 30d4
- All mentions8
- First seenAug 12, 2026
- Last mentioned8d ago
Timeline
8 articles · newest firstAPT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
76
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
62
Leaked Russian Cyber-Operations Training Materials
Leaked Bauman university records reveal a formalized Russian pipeline training GRU cyber personnel, linking a graduate to Sandworm's Military Unit 74455.
42
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
72
Appears with
- APT28threat actor · 6
- Sandwormthreat actor · 4
- Fancy Bearthreat actor · 4
- Recorded Futureorganization · 4
- Hookedgemalware · 4
- Forest Blizzardthreat actor · 3
- Symantecorganization · 3
- CERT-UAorganization · 2
- Swallowtailthreat actor · 2
- Microsoft Wordproduct · 2
- APT44threat actor · 2
- Military Unit 74455organization · 2
- Bauman Moscow State Technical Universityorganization · 2
- BlueDeltathreat actor · 2
- Microsoft Edgeproduct · 2
- Yggdrasilproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.