AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

First seen 16 Dec 2025, 12:56 UTC •Aws.AmazonThecyberexpressScworldMashable •84% similarity •60.0

Article Content

Browse articles
ThreatCluster

Amazon Web Services (AWS) has linked a multi-year cyber espionage campaign targeting Western critical infrastructure, particularly in the energy sector, to the Russian GRU-affiliated group Sandworm (APT44). The campaign has evolved to exploit misconfigured customer network edge devices as the primary access vector, replacing traditional vulnerability exploitation methods.

ThreatCluster AI

Extracted Entities

1 / 2

Community

Browse all →