AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

Thecyberexpress

AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

First seen 16 Dec 2025, 12:56 UTC • •60.0

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Amazon Web Services (AWS) has linked a multi-year cyber espionage campaign targeting Western critical infrastructure, particularly in the energy sector, to the Russian GRU-affiliated group Sandworm (APT44). The campaign has evolved to exploit misconfigured customer network edge devices as the primary access vector, replacing traditional vulnerability exploitation methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (4)

Threat Graph

9 entities, 17 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (4)

APT44
GRU
Sandworm
Seashell Blizzard

Technique (3)

Malware
T1021 - Lateral Movement
T1550.003 - Credentials In Transit

Affected Platform (1)

Amazon EC2

Tool (1)

TFTP

Relationships

APT44 uses TFTP
GRU uses TFTP
Sandworm uses TFTP
Seashell Blizzard uses TFTP
APT44 uses Malware
APT44 uses T1021 - Lateral Movement
APT44 uses T1550.003 - Credentials In Transit
GRU uses Malware
GRU uses T1021 - Lateral Movement
GRU uses T1550.003 - Credentials In Transit
Sandworm uses Malware
Sandworm uses T1021 - Lateral Movement
Sandworm uses T1550.003 - Credentials In Transit
Seashell Blizzard uses Malware
Seashell Blizzard uses T1021 - Lateral Movement
Seashell Blizzard uses T1550.003 - Credentials In Transit
APT44 related to Amazon EC2

Following this threat?

Track APT44 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Russian Phishing Campaign Targets Signal Users in NATO Countries The Czech Republic's NÚKIB has confirmed that Russian actors are conducting targeted phishing campaigns against Signal users, exploiting the app's device linking feature. This operation has affected users in five NATO nations: the Czech Republic, Ukraine, Germany, France, and the Netherlands. The attackers are not…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…