Sandworm

Product
Solutions
Resources
Company

Schedule a demo

Campaign of the month

Learn about the latest cyber attacks and vulnerabilities in our monthly Campaigns.

Spotlight on APT44 (Sandworm): Defend Against a Notorious Threat

APT44—also known as Sandworm, ELECTRUM, and VOODOO BEAR—is a destructive threat group linked to Russia’s Unit 74455. Active since 2009, it targets governments, defense, energy, media, and civil organizations, disrupting elections, leaking data, and attacking critical infrastructure.

This month’s Spotlight equips you with the insights and strategies needed to counter Sandworm using Cyber Threat Intelligence (CTI).

What You’ll Learn:

✅ Sandworm’s tools, tactics, and attack methods
✅ Key targets and their impact on critical sectors
✅ Their role in election interference
✅ Effective mitigation strategies
✅ How to use CTI for proactive defense

Stay ahead of evolving cyber threats—explore this month’s Spotlight and strengthen your security.

Past campaigns

Exploring CVE-2025-8088: How WinRAR became vulnerable to path traversal

On July 18th, 2025, ESET researchers publicly disclosed the CVE-2025-8088 vulnerability. Although WinRAR’s response was swift with the release of a patch (version 7.13) on July 30, 2025 the window between disclosure and patch availability was long enough for adversaries to weaponize the flaw and conduct successful intrusions. This campaign explores in depth how CVE-2025-8088 […]

Dissecting ToolShell: Multi-stage exploit chain targeting Microsoft SharePoint

Microsoft recently faced critical vulnerabilities in on-premises SharePoint servers that have been actively exploited in the wild. To mitigate these threats, Microsoft issued customer guidance and released security updates for CVE-2025-53770 and CVE-2025-53771, covering all supported SharePoint versions. In this month’s campaign, we’re dissecting this multi-stage exploit chain, known as the ToolShell campaign. Let’s dig […]

Exploring real-world MSI™ Afterburner RTCore driver exploitation

Threat actors are increasingly exploiting legitimate signed software to gain elevated privileges and bypass system defenses. In this month’s campaign, we will explore the RTCore driver (RTCore64.sys) from MSI™ Afterburner, used for overclocking graphics cards, and how, when running in kernel mode, it can provide low-level access to hardware. Overview of the RTCore driver exploitation […]