Sandworm misconfigured-network-edge-device campaign targeting critical infrastructure
Campaign
Summary
Hide ▲
Show ▼
A Sandworm-linked Russian campaign has shifted in 2025 from exploiting flaws to abusing misconfigured network edge devices, increasing access risk for critical infrastructure organizations and other cloud-hosted environments. The operators are using packet capture to steal credentials and then stage replay attacks and lateral movement. Earlier phases relied more heavily on zero-day and n-day exploitation. The campaign was disrupted and victims were notified.
Related Happenings
MuddyWater broad cyber-espionage campaign across sectors and countries
Campaign
H score37
First: 14.05.2026 00:59
Last: 14.05.2026 00:59
Sources 1
About this happening:
MuddyWater was tied to a 2026 espionage campaign affecting at least nine organizations across nine countries on four continents, with victims in industrial a...
MuddyWater broad cyber-espionage campaign across sectors and countries
CampaignAbout this happening: MuddyWater was tied to a 2026 espionage campaign affecting at least nine organizations across nine countries on four continents, with victims in industrial a...
FamousSparrow Azerbaijanian oil-and-gas targeting campaign
Campaign
H score32
First: 13.05.2026 16:00
Last: 13.05.2026 16:00
Sources 1
About this happening:
The China-linked FamousSparrow group ran a targeted cyberespionage campaign against an Azerbaijanian oil-and-gas company in the South Caucasus, highlighting a new...
FamousSparrow Azerbaijanian oil-and-gas targeting campaign
CampaignAbout this happening: The China-linked FamousSparrow group ran a targeted cyberespionage campaign against an Azerbaijanian oil-and-gas company in the South Caucasus, highlighting a new...
Industrial ransomware targeting surged in 2025 across OT-linked environments
Trend
H score58
First: 17.02.2026 14:50
Last: 17.02.2026 14:50
Sources 1
About this happening:
Industrial organizations saw a sharp rise in ransomware targeting in 2025, increasing the risk of OT disruption across critical sectors. The trend matters because atta...
Industrial ransomware targeting surged in 2025 across OT-linked environments
TrendAbout this happening: Industrial organizations saw a sharp rise in ransomware targeting in 2025, increasing the risk of OT disruption across critical sectors. The trend matters because atta...
AWS EC2 and ECS cryptomining campaign using compromised IAM credentials
Campaign
H score35
First: 17.12.2025 23:48
Last: 17.12.2025 23:48
Sources 1
About this happening:
An ongoing crypto-mining campaign is abusing compromised IAM credentials to mine on AWS EC2 and ECS, draining customer compute and slowing response. The operation...
AWS EC2 and ECS cryptomining campaign using compromised IAM credentials
CampaignAbout this happening: An ongoing crypto-mining campaign is abusing compromised IAM credentials to mine on AWS EC2 and ECS, draining customer compute and slowing response. The operation...
APT44 years-long Russian campaign targeting Western critical infrastructure
Campaign
H score38
First: 16.12.2025 14:27
Last: 16.12.2025 14:27
Sources 1
About this happening:
A years-long Russian campaign by APT44 targeted Western critical infrastructure from 2021 to 2025, increasing the risk of credential theft and downstream network c...
APT44 years-long Russian campaign targeting Western critical infrastructure
CampaignAbout this happening: A years-long Russian campaign by APT44 targeted Western critical infrastructure from 2021 to 2025, increasing the risk of credential theft and downstream network c...
Timeline
-
16.12.2025 15:22 2 articles · 7mo ago
Sandworm-linked Russian campaign shifts to misconfigured edge devices
Initial DisclosureAmazon’s threat intelligence team says Sandworm-linked Russian state-sponsored actors shifted in 2025 from exploiting zero-day and n-day vulnerabilities, including CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-27532, to targeting misconfigured network edge devices at critical infrastructure and other cloud-hosted organizations; the operators used native packet-capture capabilities to steal credentials, then replay attacks and lateral movement, and Amazon says it disrupted the campaign and notified victims.
Show sources
- Amazon: Russian Hackers Now Favor Misconfigurations in Critical Infrastructure Attacks — www.securityweek.com — 16.12.2025 15:22
- Amazon: Russian Hackers Now Favor Misconfigurations in Critical Infrastructure Attacks — www.securityweek.com — 16.12.2025 15:22