The Secret Life of Sandworms
summary
Newly uncovered campaigns attribute a cluster of operations to Sandworm that go beyond destructive ramps and election leaks: targeted compromises of Ukrainian app developers and backdoored Play Store apps (dex modification and wrapper implants), a modular mobile backdoor that queues data for Wi‑Fi exfiltration, reuse of PowerShell Empire via malicious Office macros, and widespread credential‑phishing waterholes served by redirects from ~25 compromised sites. Investigators see a Tor‑hosted C2, a few hundred infected devices in early campaigns, and at least one supply‑chain upload stopped at publication.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:572017 French Presidential Elections
- 6:22The devil's in the Rich header
- 12:052018 Russian Business Campaigns
- 13:07Software Supply Chain Attacks
- 23:26Acknowledgements
related talks
56mCybersecurity & Privacy From The Global Lens
32mWhat is a Threat Actor? Tracking Sandworm's Transformation
30mReversing Mobile Malware
26mTracking the World's Dumbest Cyber Mercenaries
46mAttacks, Lies and the Underground World
45mThe Discovery of a Government Malware and an Unexpected Spy Scandal
26mUnder the SEA - A Look at the Syrian Electronic Army's Mobile Tooling
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops