Sandworm in 2025: Infrastructure Patterns, Updated TTPs, and Detection Opportunities

Sandworm — formally tracked as APT44, FROZENBARENTS, and by GRU unit 74455 — remains the most operationally active and destructive state-linked threat actor targeting Ukrainian critical infrastructure. Since the full-scale invasion began in February 2022, the group has evolved from high-profile wiper deployments (AcidPour, CaddyWiper, WhisperGate) toward a more durable persistence-and-collection posture.

This report summarises AmonSul's current intelligence picture, including infrastructure fingerprinting signatures observed during our MDR operations, updated persistence mechanisms active in early 2025, and detection rules tested against real Sandworm artefacts.

Scope note: This report covers tradecraft observed in operations targeting Ukrainian defence technology companies and critical infrastructure. Some TTPs described here reflect classified intelligence shared under NDA with incident response clients; specific indicators are generalised to protect ongoing investigations. Full IOC packages are available to VATRA subscribers.

Who is Sandworm

Sandworm operates under Russia's General Staff Main Intelligence Directorate (GRU), specifically within Main Centre for Special Technologies (GTsST) — Unit 74455. The unit was formally indicted by the US Department of Justice in 2020 for attacks including NotPetya, the 2016 and 2022 Ukrainian power grid attacks, and interference in the 2017 French elections.

Sandworm's distinguishing characteristics compared to other GRU units (e.g., APT28/Fancy Bear/Unit 26165) are:

• Destructive capability. Sandworm maintains ready-to-deploy wiper tools and Industrial Control System (ICS) attack frameworks. APT28 focuses primarily on espionage.
• ICS expertise. The group developed Industroyer (2016) and Industroyer2 (2022), the only known purpose-built ICS attack frameworks deployed against operational power infrastructure.
• Long dwell time. Sandworm operations often involve 6–18 months of pre-positioning before a destructive payload deploys. They are patient.
• Ukrainian infrastructure focus. While the group has operated globally, Ukrainian targets account for the majority of known destructive operations since 2015.

Evolution of Tactics: 2023–2025

From Wipers to Persistence

The period from mid-2023 onward has seen a measurable shift in Sandworm's operational tempo. Large-scale wiper deployments have decreased while stealthy long-term access operations have increased. Our assessment is that this reflects two operational priorities:

1. Intelligence collection ahead of possible negotiations. Long-term access to government and defence networks has higher intelligence value than destroying them.
2. Pre-positioning for future escalation. Dormant access in critical infrastructure — power, water, communications — maintains options for rapid escalation if the strategic situation changes.

Updated Persistence Mechanisms

Living-off-the-land (LOTL) at scale. Sandworm's 2024–2025 operations have dramatically increased their use of built-in Windows tools and legitimate administration software to avoid detection. We have observed WMI subscriptions, scheduled tasks using LOLBins (msiexec, regsvr32, certutil), and abuse of Windows Management Instrumentation (WMI) for lateral movement — all designed to blend into normal enterprise telemetry.

VPN and edge device implants. Like many sophisticated threat actors, Sandworm has shifted initial access toward perimeter devices — particularly unpatched VPN appliances, firewalls, and network monitoring systems. Once an edge device is compromised, the implant is difficult to detect (limited EDR visibility) and provides persistent re-entry even if the internal network is remediated. We have observed specific targeting of Cisco IOS XE (CVE-2023-20198), Ivanti Connect Secure, and Fortinet FortiOS appliances.

Active Directory abuse. Post-initial access, Sandworm consistently targets Active Directory domain controllers for privilege escalation and persistence. Current playbook elements include DCSync abuse, forging of Kerberos tickets (Golden/Silver Ticket), and deployment of persistent AD backdoors using AdminSDHolder modification. This pattern is consistent across multiple 2024 incident response engagements.

Custom C2 frameworks. While Sandworm has historically used commercial red team tools (Cobalt Strike, Metasploit), recent operations have deployed custom C2 frameworks with communication profiles designed to mimic legitimate SaaS traffic — using HTTPS to CDN-backed infrastructure, rotating domains, and employing domain fronting techniques to evade network-based detection.

Key Infrastructure Patterns

The following fingerprinting characteristics are consistent across Sandworm infrastructure observed in 2024–2025 operations. These patterns are valuable for retrospective threat hunting and proactive blocking:

Hosting Provider Preference

Sandworm's C2 infrastructure consistently uses a small set of hosting providers that accept cryptocurrency payment and have limited abuse response capability. In 2024–2025, we have observed clustering around several providers in Russia, Eastern Europe, and Central America. Proactive blocking of bulletproof hosting ranges — while noisy — significantly reduces the effectiveness of implants that have not yet been discovered.

TLS Certificate Characteristics

Sandworm C2 servers running on compromised infrastructure or dedicated hosting consistently show TLS certificates issued within 7 days of use (short-lived, often via Let's Encrypt automation). Certificate Subject Alternative Names frequently contain typosquat versions of legitimate Ukrainian government or defence organisation domains. Certificate validity periods are typically 30–90 days.

DNS Infrastructure

Domain registration patterns show consistent use of registrars with weak identity verification, payment via cryptocurrency, and registration dates 2–7 days before first use. Domains frequently impersonate Ukrainian government (.gov.ua lookalikes), military, or defence contractor domains using Cyrillic homoglyph characters or common typosquatting patterns.

JA3/JA4 Fingerprints

Sandworm's custom C2 frameworks have consistent TLS client fingerprints (JA3/JA4) across deployments. While specific values change periodically, the underlying TLS negotiation patterns — cipher suite ordering, extension list — are distinctive relative to commodity C2 frameworks. Network monitoring solutions that support JA3/JA4-based detection can flag Sandworm C2 communications even when domain and IP indicators have rotated.

Detection Opportunities

Endpoint Detection

The following endpoint behaviours, while not unique to Sandworm, are high-fidelity indicators in the context of a Sandworm-suspected incident:

• WMI subscriptions created outside normal management tooling windows (detection: monitor __EventFilter, __EventConsumer, and __FilterToConsumerBinding class creation via Sysmon Event ID 19/20/21)
• Scheduled tasks created by processes other than the system scheduler with encoded PowerShell in the task action (Sysmon Event ID 11, Windows Security 4698)
• certutil.exe or msiexec.exe spawning unusual child processes or downloading from non-Windows Update URLs
• LSASS access from non-standard processes (Sysmon Event ID 10 with GrantedAccess 0x1fffff or 0x1010)
• AD AdminSDHolder modifications — monitor for ACL changes on the AdminSDHolder object in the System container

Network Detection

• TLS certificates with Subject Common Name matching known Ukrainian government domain patterns but issued to IP addresses in non-government ASNs
• DNS queries for domains registered within 7 days — flag new domain first-seen events for manual review in high-risk environments
• Beaconing patterns: C2 communications to CDN-backed infrastructure with consistent 30–300 second check-in intervals and low variance

Log Source Prioritisation

For defenders with limited SIEM capacity, the following log sources provide the highest Sandworm detection value per byte of log volume:

1. EDR telemetry with process creation and WMI event subscriptions — essential for detecting LOTL persistence
2. DNS query logs — required for domain reputation enrichment and C2 communication detection
3. Active Directory change logs — specifically, changes to sensitive objects (AdminSDHolder, Domain Admins group, GPO modifications)
4. Perimeter device logs (VPN, firewall) — required for detecting edge-device exploitation

What This Means for Defence Contractors

Sandworm explicitly prioritises defence technology companies and their supply chains as targets. Their current operational pattern — long dwell times, LOTL persistence, edge device focus — is specifically designed to evade the perimeter-focused security models that many organisations still operate.

Three defensive priorities follow directly from this intelligence:

Perimeter devices must be patched on a cadence measured in days, not quarters. Sandworm's preference for VPN and firewall exploitation means that a known vulnerability on a perimeter device is an open door. The remediation window between CVE publication and Sandworm exploitation has historically been 7–14 days for high-profile edge device vulnerabilities.

EDR coverage must include domain controllers. Domain controllers are routinely excluded from EDR deployments due to performance concerns. Sandworm's consistent AD targeting makes this exclusion untenable. Lightweight EDR agents with WMI and AD change monitoring should be deployed on every DC regardless of performance impact.

Supply chain security is not optional. Multiple Sandworm intrusions into defence technology companies in 2024 used a trusted supplier as the initial access vector. The supplier had weaker security controls than the target, was trusted by the target's perimeter, and provided a clean lateral movement path. Your supply chain security programme must include mandatory security baseline requirements for suppliers with any network access to your environment.

AmonSul's VATRA threat intelligence platform provides subscribers with full Sandworm IOC packages, weekly actor update briefs, and STIX/TAXII feeds compatible with most SIEM and SOAR platforms. Contact us at [email protected] for trial access.