216.73.217.22

Sandworm

· Published 20/12/2025 23:15 · Modified 20/12/2025 23:15 · Source: AlienVault

Essential information

Confidence
100/100
Published
20/12/2025 23:15
Modified
20/12/2025 23:15
Updated at
20/12/2025 23:15
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
4 reports, 73 attack patterns (mitre), 33 malware, 4 sectors, 9 countries, 100 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (4)

Attack patterns (MITRE) (73)

Malware (33)

  • CaddyWiper - S0693 uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • Dark Crystal RAT uses
    Family
    Published 12/02/2025 00:24 · Modified 12/02/2025 00:24
  • CaddyWiper
  • ORCSHRED uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • HermeticWiper - S0697 uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • Industroyer2 - S1072 uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • ZOV wiper uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • SharpNikoWiper uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • SOLOSHRED uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • Infamouse Chisel
  • SwiftSlicer uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • HermeticRansom uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • GreyEnergy - S0342
  • AcidRain uses
    Family
    Published 13/11/2025 23:20 · Modified 13/11/2025 23:20
  • DynoWiper uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • BidSwipe uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • RansomBoggs uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • Kapeka
  • Kalambur uses
    Family
    Published 12/02/2025 00:24 · Modified 12/02/2025 00:24
  • NikoWiper uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • DoubleZero uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • ZEROLOT uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • ROARBAT uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • ZeroWipe
  • BACKORDER uses
    Family
    Published 12/02/2025 00:24 · Modified 12/02/2025 00:24
  • Prestige - S1058 uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • SDelete
  • AcidPour
  • HermeticWiper uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • Sting wiper uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • AWFULSHRED uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42
  • DcRAT uses
    Family
    Published 01/03/2026 05:26 · Modified 01/03/2026 05:26
  • ARGUEPATCH uses
    Family
    Published 30/01/2026 18:42 · Modified 30/01/2026 18:42

Sectors (4)

  • Energy targets
  • Defense targets
  • Telecommunications targets
  • Government targets

Countries (9)

  • United States of America targets
  • Australia targets
  • Estonia targets
  • Poland targets
  • Canada targets
  • Ukraine targets
  • New Zealand targets
  • Belarus targets
  • United Kingdom of Great Britain and Northern Ireland targets

Indicators (100)

  • f3280e61f7c810457b8c6741aa57bdceb1dd918d18f16d314761a49788665877 indicates
  • 426a480c6c11190cc9d7c069ef409ae0b6bffa13 indicates
  • c13270594f873bb188f893f307d1ec94aa21ee4c3b90301e168eec3a21a055ca indicates
  • 272cfaebf22e0f6a34c0a93b7c9c5b67c725947ba0f17e60ed67dbf6e1602043 indicates
  • https://185.225.114.90/accept indicates
  • progamevl.ru indicates
  • fdc3f0516e1558cc4c9105ac23716f39a6708b8facada3a48609073a16a63c83 indicates
  • 4e6582b8ff2fb2e91cc31de2f4ed4f72ef7ac52845d4dbfabf36081d849bba64 indicates
  • d1871e43c0a5ebc123eafa91b44ce00636ef02a3 indicates
  • yuknkap4im65njr3tlprnpqwj4h7aal4hrn2tdieg75rpp6fx25hqbyd.onion indicates
  • a42de97a466868efbfc4aa1ef08bfdb3cc5916d1accd59cfffff1a896d569412 indicates
  • 33a2be6638be67ba9117e0ac7bad26b12adbcdf6f8556c4dc2ff3033a8cdf14f indicates
  • http://194.61.121.211/application indicates
  • f30b9f6e913798ca52154c88725ee262a7bf92fe7caac1ae2e5147e457b9b08a indicates
  • e76f78c5afbd1d1a3fefa7a37d1737f9cb06197f4a6d6dd8f7b74f3978362a9f indicates
  • http://kmsupdate2023.com/kms2023.zip indicates
  • f38d170804471b31490d23fb483e0dd81c1a8be3 indicates
  • 4e568242667c61a1551d3e5f3e42107c43db5d989647b333325d10840cd2d58e indicates
  • 70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8 indicates
  • http://91.92.137.164/json indicates
  • 001208a304258c23a0b3794abd8a5a21210dfeaf106195f995a6f55d75ef89cd indicates
  • c237f1a3f75b2759f66ec741448bb352e95e186a9a689f87c8641b44a13d878b indicates
  • 4a4dde90762accb8d61caad9923f1473c6d8ee493c7dc6c482dfd52c9f8fc2f5 indicates
  • c3859810b9842daf129bc887e7b267ae70ba985387b1cea0fc62270c74c3d4a6 indicates
  • solntsepek.ru indicates
  • 5c5323bd17fd857a0e77be4e637841dad5c4367a72ac0a64cc054f78f530ba37 indicates
  • solntsepek.org indicates
  • 553f7f32c40626cbddd6435994aff8fc46862ef2ed8f705f2ad92f76e8a3af12 indicates
  • ce85f5bcd52c79582a66bc7ef3f11f4ac74e9cc9962551b5912ac6bfa78ea841 indicates
  • 5fdb577b5ce71c42032c77cf41b3a4478726dff5a234abd0a26ff0bdd42e4ef9 indicates
  • dc31de076eb9b2407bc4e7fa44216f906f0857271d71a2ea2fb6f35c96cd8f35 indicates
  • 827278ad89486debd79c6bfc38d8b00fa5fb90ad indicates
  • 9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a indicates
  • 5866e1fa5e262ade874c4b869d57870a88e6a8f9d5b9c61bd5d6a323e763e021 indicates
  • 3afbb6767c5b39888b4ddf7bc459cc1fea223e2e indicates
  • 7269b4bc6b3036e5a2f8c2a7908a439202cee9c8b9e50b67c786c39f2500df8f indicates
  • bfda142bc5c44913eed9ef1cf2a8ad07b7a71312a26e4c7c519bf1a3fedeb6a0 indicates
  • 29c21a87bed19457f7f76e5f39c818ad563a2ddb203961bb2295263d8e875044 indicates
  • 648c2067ef3d59eb94b54c43e798707b030e0383b3651bcc6840dae41808d3a9 indicates
  • 645821ba80859651cdb8c1c1f8129702a85503c62b0c3ce74f99d50214f67244 indicates
  • 807bfade291ab71c1bb47ef2c18a52d6db7b7546f28a421edf18ebeae5ad00aa indicates
  • https://178.250.188.114/ubuntu/focal indicates
  • http://178.250.188.114/ubuntu/focal indicates
  • 52faa381392c1a86b537096c2730de5aeab9be7512bde9536aef84857b19753e indicates
  • kalambur.net indicates
  • 744364ea94245c26aabfdedc4a6fae2e2d188fbe3c851f439b27ed8a9084a9d1 indicates
  • 2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion indicates
  • http://onedrivepack.com/pipe_RequestPollUpdateProcessAuthwordpress.php indicates
  • 5d3a6340691840d1a87bfab543faec77b4a9d457991dd938834de820a99685f7 indicates
  • 0e58d38fd2df86eeb4a556030a0996c04bd63e09e669b34d3bbc10558edf31a6 indicates
  • 61b0246202707414da97911c0447eed70499e02285db9190a5842de748ae0bd1 indicates
  • bdd7b08ab069c71877352e4cf7cf0e1e14b14ccffd3fb827a81ed6fc564ff99b indicates
  • a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92 indicates
  • 00782ccd65a1e03e3e74ce1e59e752926e0a050818fa195bd7e5a5b359500758 indicates
  • 5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57 indicates
  • 5557aea34234deb015d8e6c39ea2945bad6dd4e9dfe5278265c1183aa3942394 indicates
  • 338f8b447c95ba1c3d8d730016f0847585a7840c0a71d5054eb51cc612f13853 indicates
  • 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5 indicates
  • 3cf2de421c64f57c173400b2c50bbd9e59c58b778eba2eb56482f0c54636dd29 indicates
  • 66548ba6ca6d34b7d17e42ab2e1405db1c581a516e0b1a4942d373d6d5396ba4 indicates
  • 8a4df53283a363c4dd67e2bda7a430af2766a59f8a2faf341da98987fe8d7cbd indicates
  • cca9accd3c1554703ab11eb9c10b146d9d8a84ea165450003200de1ebbc2ac4c indicates
  • bcdf0bd8142a4828c61e775686c9892d89893ed0f5093bdc70bde3e48d04ab99 indicates
  • 40a4b5e54fecce52c9d8ef5b2fa3973a3dd748c5bcedd7bde1154aa4a936c2e1 indicates
  • 63939d3bd170846a95b124c09a4b6399ab1e790d0c2f407141de9265efc51ee9 indicates
  • https://91.92.137.164/json indicates
  • 31.172.71.5 indicates
  • d8d3a1c24a12795f0c65509db8b40c26396a51d0dfa258b6fc317e8b2270c5a3 indicates
  • kms-win11-update.net indicates
  • feae0ab35affa24c52650c9da789cf214d4f7c37bdef3e4d0412feb4aaa3b4db indicates
  • activationsmicrosoft.com indicates
  • daa0ebaf4c704a80cb79dd655c816b922d7480b6d97e53e4015ee96d936245b5 indicates
  • cd7c36a2f4797b9ca6e87ab44cb6c8b4da496cff29ed5bf727f0699917bae69a indicates
  • bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f indicates
  • main.show indicates
  • 7cddf5eabb6e59b9901e6a68996413e3469f8c56b4da92cf24c18862221c3046 indicates
  • e3bc3689f01fd431cd2ed368ae91eceaa7c465c2781fa7b7dc2ec9143a404f79 indicates
  • 1a1ffcbab9bff4a033a26e8b9a08039955ac14ac5ce1f8fb22ff481109d781a7 indicates
  • 294a16e3d8f507cdcfaa4582b0f93427fe924ad8 indicates
  • taibdsgqlwvnizgipp4sn7xee72qys3pufih3rjzhx3e5b5t245kafid.onion indicates
  • 44e0aa08ef5fdb2aec2f393078204fb70e271b63 indicates
  • 6ca881729c4610cb08f0f54fa1ff2ad9a0f56313da8ae5caa3746f8c1cd527b2 related
  • a29944006225bb5cb0dacf597ef614cf947a8ac088cec90c954506b38ebdc28e related
  • a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea related
  • 4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382 related
  • a97252c1a675d3c64dc806181e64f0a0e86914a540476b08cc578d94759ee082 related
  • 06584cc9f5bc80964b80220064dda52e822e81ad1d0053f4390ca1433c64971b related
  • a0eed0e1ef8fc4129f630e6f68c29c357c717df0fe352961e92e7f8c93e5371b related
  • kmsupdate2023.com related
  • 1dbb018010a79d869f9a3f61907f81e61e15a366efe7302e26d93946754cd311 related
  • 203890c3e60ccd4e05a2f9b1a784b010bb2d42d6 related
  • 8369d112dc42151ceb3aaa6eca96fb66a08e631a2f18860d716a0604a80da76c related
  • 3c5e7c6da03c5f66d71332a34b3a1f57fed05d3de624f05dae50f7b14a4e44b3 related
  • e2551b76534f0646fccbffd01856948b8f440618afd2b17cda6a9ae59e8e28f7 related
  • 602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7 related
  • https://196.245.156.154/map/title related
  • 9a76e608afca114f18e2b794e9a557b910f43e575c816019a49876188602c3aa related
  • 8a7b3a7a9a4e8b7fd45c94b56ac59f6e15b6560f692756cf6050342bea06a1b3 related
  • https://165.231.34.106/users/me related
  • 4571860df3a7c8f67db93bd038c1847ddda5ef4b0b23e631d814778ab7a5d549 related