SWSandworm Watch
target entity

energy

5 source-linked records in the current knowledge graph.

unknown

HelloNet campaign: a threat via the ViPNet update system

An active APT campaign discovered in May 2026 exploits the ViPNet update system to deploy previously unknown tooling against large Russian organizations. Attackers achieve persistence through DLL sideloading, placing malicious wtsapi32.dll in ViPNet directories. The campaign employs multiple components: HelloInjector loader, HelloProxy for traffic proxying and payload delivery, HelloExecutor backdoor for command execution, HelloCleaner for log file sanitization, and HelloBackdoor written in Rust for file manipulation. Attackers conduct reconnaissance activities, establish SSH tunnels using renamed PuTTY utilities, and target government, energy, transport, education, logistics, and industrial sectors. Attribution points to an unknown Chinese-speaking APT group with low confidence based on strings referencing sina.com and Chinese package repositories.

chinese aptdll sideloadinghellobackdoor
AlienVault OTX ↗ · unattributed attribution · 15 IOCs
unknown

ATT&CK profile: Sandworm Team

[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365

Sandworm TeamBlackEnergy (Group)ELECTRUMIRIDIUM
MITRE ATT&CK ↗ · confirmed attribution · 3 IOCs
high

CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability

A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered. Required action: The impacted product is end-of-life and should be disconnected if still in use.

CVE-2018-7841EPSS 72.5%Schneider ElectricU.motion Builder
CISA KEV ↗ · unattributed attribution · 1 IOC
critical

Ukraine electric power disruption

Sandworm-linked activity disrupted electricity distribution, a landmark cyberattack against civilian infrastructure.

Sandworm TeamICSUkrainecritical infrastructure
MITRE ATT&CK ↗ · confirmed attribution