Voodoo Bear

VOODOO BEAR, also known as Sandworm, Seashell Blizzard, and other names such as Iridium, Iron Viking, Telebots, and APT44, is a highly advanced threat actor with a suspected nexus to the Russian Federation. First identified in January 2018, this group has been active since 2000 and operates under the control of Military Unit 74455, a cyber warfare unit of the Russian military intelligence service (GRU). The group has been attributed to several destructive operations, including the infamous Kyivstar attack, and uses sophisticated malware tools like a wiper called PassKillDisk. The group's activities have been notably aggressive against Ukraine, where it has targeted critical infrastructure during Russia's ongoing conflict with the country. These include two significant disruptions to the Ukrainian electricity grid in 2015 and 2016. Western intelligence agencies link VOODOO BEAR directly to Russia's GRU military intelligence agency, indicating state sponsorship behind these cyber-attacks. The group has also used hacktivist fronts like Solntsepek for their operations, adding another layer of complexity to their tactics. Despite the serious threat posed by VOODOO BEAR, cybersecurity firms like CrowdStrike offer solutions to incorporate intelligence on such threat actors to enhance organizational security. Further information on these services can be found on CrowdStrike's Falcon Intelligence product page. The identification and tracking of VOODOO BEAR underline the critical need for robust cybersecurity measures in the face of state-sponsored cyber threats.