Apt44

APT44, also known as Sandworm, is a threat actor newly designated by Mandiant and associated with the Russian military intelligence hacking team. This group has been active since the start of 2023, conducting campaigns leveraging Sandworm malware, primarily targeting Ukraine, Eastern Europe, and investigative journalists. The operators behind APT44 are believed to have the ability to direct and influence the CyberArmyofRussia_Reborn's activity across multiple platforms, making them a significant part of cyber warfare between Russia and Ukraine. Between December 2023 and January 2024, APT44 targeted investigative journalists, including the Netherlands-based group Bellingcat. By April 17, Mandiant had upgraded Sandworm to a named Advanced Persistent Threat (APT) group, APT44. The group exploited remote code execution vulnerabilities in third-party software due to inadequate network segmentation and supplier negligence, further emphasizing their capabilities and threat level. In March, APT44 launched a major assault on Ukrainian critical infrastructure, targeting 20 sites to amplify the impact of missile strikes on the war-torn country. This was attributed to APT44 using Queueseed and Gossipflow malware. As a specialized cyber division within Russia's military intelligence service, Sandworm serves Russia's wide-ranging national interests and ambitions, including efforts to undermine democratic processes globally. This makes APT44 a global menace and a substantial threat to cybersecurity.