Russian Sandworm Targets Infrastructure via Misconfigurations

A Russian state-sponsored cyberespionage group linked to the country's Main Intelligence Directorate, or GRU, has been targeting critical infrastructure organizations in North America, Europe and the Middle East since at least 2021, with a particular focus on the energy sector, according to a report from Amazon Threat Intelligence. The group, tracked as Sandworm or APT44, shifted its tactics this year to exploit misconfigurations in network edge devices rather than software vulnerabilities, enabling persistent access to victims' systems while minimizing detection risks.

The campaign initially relied on known and zero-day vulnerabilities to breach networks from 2021 to 2024. Attackers exploited flaws such as CVE-2022-26318 in WatchGuard Firebox and XTM appliances, CVE-2021-26084 and CVE-2023-22518 in Atlassian Confluence, and CVE-2023-27532 in Veeam Backup software. These methods allowed initial access to enterprise routers, VPN concentrators, remote access gateways, network management appliances, collaboration platforms and cloud-based project management systems. However, telemetry from Amazon showed a sharp decline in such exploitation starting in 2025, replaced by a sustained...