Sandworm

Russia's Sandworm APT group (also tracked as APT-44, UAC-0135, Voodoo Bear) is a unit of the Russian GRU's Main Centre for Special Technologies (GTsST).

CAPTCHA Social Engineering Campaign (July 2026)

• Observed technique: Fake CAPTCHA verification pages targeting Ukrainian users
• Lure: Victims are prompted to complete a CAPTCHA to access a website
• Payload: The CAPTCHA tricks victims into running malicious PowerShell commands
• Result: Grants attackers system-level access to the victim's machine
• Discovered by: The Record by Recorded Future (raw/digests/Cyber-Digest-2026-07-18.md)

This novel social engineering approach evades traditional email-based phishing detection by hosting the lure on legitimate-looking websites that use CAPTCHA as a trust signal.

Fake-Recruitment Campaign Against Ukrainian IT Staff (Aug 2026)

CERT-UA reported that Sandworm (APT44/Seashell Blizzard) has run a fake-recruitment operation since at least May 2026, impersonating recruiters on Ukrainian job sites and targeting system administrators and IT professionals. Lures deliver a modified "SoPraVPN" app built from WireGuard code that covertly executes commands on the victim's machine. (The Record, 2026-08-11)(raw/digests/Cyber-Digest-2026-08-11.md)

Related Pages

• Cisa Acsc Russian Network Devices — Joint advisory on Russian targeting of network infrastructure
• Operation First Light 2026 — Large-scale anti-scam operation