Skip to content

Sandworm

In 8 briefs, most recently 23 October 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

Fri 23 Oct Capcom ID breach of 11.7M accounts, LiteLLM PyPI supply chain attack, and actively exploited Arista VeloCloud zero-day.
Tue 15 Sep Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
Wed 12 Aug Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
Sat 31 Jan The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
Tue 27 Jan Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
Sun 25 Jan Nike breach claimed by WorldLeaks, Sandworm's failed DynoWiper attack on Poland's grid, and CISA KEV addition for VMware vCenter CVE-2024-37079.
Sat 24 Jan Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
Fri 07 Nov The SonicWall cloud backup breach, Sandworm's wiper attacks on Ukraine, Cisco UCCX patches (CVE-2025-20333), and a $128M Balancer DeFi exploit.