Thecyberexpress

AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

First seen 16 Dec 2025, 12:56 UTC • Aws.Amazon

•60.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Amazon Web Services (AWS) has linked a multi-year cyber espionage campaign targeting Western critical infrastructure, particularly in the energy sector, to the Russian GRU-affiliated group Sandworm (APT44). The campaign has evolved to exploit misconfigured customer network edge devices as the primary access vector, replacing traditional vulnerability exploitation methods.

How this analysis works

Attack Flow

9 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (4)

Apt44
GRU
Sandworm
Seashell Blizzard

Technique (3)

Malware
T1021 - Lateral Movement
T1550.003 - Credentials In Transit

Affected Platform (1)

Amazon EC2

Tool (1)

TFTP

Relationships

Apt44 uses TFTP
GRU uses TFTP
Sandworm uses TFTP
Seashell Blizzard uses TFTP
Apt44 uses Malware
Apt44 uses T1021 - Lateral Movement
Apt44 uses T1550.003 - Credentials In Transit
GRU uses Malware
GRU uses T1021 - Lateral Movement
GRU uses T1550.003 - Credentials In Transit
Sandworm uses Malware
Sandworm uses T1021 - Lateral Movement
Sandworm uses T1550.003 - Credentials In Transit
Seashell Blizzard uses Malware
Seashell Blizzard uses T1021 - Lateral Movement
Seashell Blizzard uses T1550.003 - Credentials In Transit
Apt44 related to Amazon EC2

Continue Reading

Sandworm Launches Wiper Malware Campaign Against Ukrainian Organizations Exploitation of WinRAR CVE-2025-8088 Threatens Ukrainian Organizations Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users UAC-0099 Exploits Notepad++ to Distribute Malware in Ukraine Sandworm Hackers Use Fake Job Interviews to Deploy Trojanized VPN Client Sandworm Targets Critical Infrastructure with Aggressive OT Attacks

AWS Attributes Cyber Espionage to Russian GRU-linked Group Sandworm

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading