APT44: Russia's Sandworm group has launched multiple attacks and espionage campaigns targeting OT systems

Sandworm is one of Russia's most prominent threat groups, with most of its cyber operations targeting espionage, sabotage, or disinformation. It is renowned for using highly destructive malware such as BlackEnergy and Industroyer.

Since the start of Russia's war against Ukraine, the group has been dedicated to creating chaos within Ukraine, using wipers and other tactics to achieve its objectives. Their cyber operations are often synchronized with conventional military activities.

Some have considered Sandworm to be identical to APT28 (Fancy Bear). Although some of their activities overlap, they are actually distinct groups, which is why Sandworm has just been upgraded and named APT44.

APT44 has been utilizing multiple hacktivist personas, including Cyber Army of Russia Reborn (CARR), XAKNET, and Solntsepek.

In recent months, CARR has claimed the capability to manipulate operational technology (OT) assets of critical infrastructure in the US and the EU.

In January, the "hacktivists" posted videos showing they could manipulate the Human-Machine Interfaces (HMIs) of Polish and US water utilities. In March of this year, the group posted a video purporting to show them disrupting power generation at a hydroelectric facility in France by manipulating water levels.

While their claims could not be independently verified, public information suggests that the hackers may have indeed caused some level of disruption.

About two weeks after the attacks targeting the US, a Telegram post emerged in which a local official publicly confirmed a "system malfunction" that caused a water tank at one of the victim facilities to overflow. This activity was reportedly part of a series of cyber incidents affecting multiple local water infrastructure systems in the US, stemming from "vendor software they used that allowed remote access to the water system."

APT44 has been linked to multiple attack incidents.

For instance, since at least April 2023, APT44 has provided infrastructure that could be used by forward-deployed Russian military units to steal encrypted Signal and Telegram messages from mobile devices captured on the battlefield.

APT44 has also launched supply chain attacks involving wiper malware.

In a recent case, compromise of a software developer led to downstream compromises of critical infrastructure networks in Eastern Europe and Central Asia, followed by the deployment of wiper malware to selected victim organizations.

Recent attacks targeting the Dutch investigative journalism organization Bellingcat and other similar entities have also now been attributed to APT44 for the first time.

Additionally, according to information from Malpedia, APT44 is also tracked under other aliases such as Blue Echidna, Electrum, FrozenBarents, G0034, Iridium, Iron Viking, Quedagh, Seashell Blizzard, TEMP.Noble, TeleBots, UAC-0082, UAC-0113, and Voodoo Bear.

Attack simulation rules targeting the tactics employed by this threat group have been integrated into the SecurityGauge validation platform. You can search for the keywords "Sandworm" or "APT44" within the SecurityGauge validation platform to access relevant attack simulation validation actions. This allows you to verify whether your security defense system can effectively counter attacks from this threat group, with the platform ensuring your validation process is safe and harmless in an industry-unique manner.