CTI Research: Sandworm / APT44

A comprehensive, evidence-labeled cyber threat intelligence report on Sandworm/APT44 (GRU Unit 74455) covering 2009 through March 2026. The report details the group's evolution from bespoke ICS attacks (Ukraine grid disruptions, NotPetya, Industroyer) to a scalable wartime playbook combining edge-device compromise, Living-off-the-Land techniques, GPO-based wiper deployment, and influence persona operations. Key findings include: a sustained shift toward misconfigured edge-device targeting for initial access, an active wiper development pipeline (ZEROLOT, Sting, ZOV, DynoWiper, LazyWiper), expansion into tactical battlefield intelligence support via Signal/Telegram interception (WaveSign tool) and drone supply-chain targeting, and integration with criminal marketplaces. The report includes a full malware portfolio, ATT&CK-aligned TTPs, IOC compendium, SOC detection engineering guidance, a 30-minute wiper/OT defensive playbook, and NIST CSF-lite controls mapping. Attribution confidence is assessed as high at cluster level, with specific incident-level caveats (e.g., contested December 2025 Poland energy incident).