apt44-unearthing-sandworm.pdf

This Mandiant report, “APT44: Unearthing Sandworm,” attributes a wide range of espionage, disruptive (wiper) and influence operations to APT44 (Unit 74455/GRU), documents its global targeting mandate and wartime focus on Ukraine, catalogs extensive custom and commodity malware families and hunting rules, outlines observed TTPs (edge exploitation, LOTL, supply‑chain compromise, OT targeting), and provides IOCs and mitigation guidance; the report assesses APT44 as a highly capable, state‑sponsored actor responsible for destructive attacks against critical infrastructure and election/information operations.