Sandworm is a threat actor attributed to RU, also known as IRIDIUM, Sandworm, BE2. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Sandworm exploit?

Sandworm is known to exploit 6 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Sandworm

Also known as: IRIDIUM, Sandworm, BE2, VOODOO BEAR, CTG-7263, GRU military unit 74455, ELECTRUM, UNC3810, Curly COMrades, G0034, UAC-0125, Sandworm Team, Grey Tornado, UAC-0082, Phantom, BlackEnergy Lite, ATK 14, Blue Echidna, BlackEnergy (Group), FROZENBARENTS, TEMP.Noble, APT 44, IRON VIKING, Seashell Blizzard, Hades, Razing Ursa, Voodoo Bear, Telebots, Iron Viking, TeleBots, APT44, UAC-0113, UAC-0133, Quedagh

RUSabotage and destruction

Exploited CVEs

Overview

This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage

Exploited Vulnerabilities

CVE ID	Action
CVE-2014-7169	View Details