apt44

Iridium is a Russian state-sponsored threat actor, also widely known as Sandworm, Seashell Blizzard, Voodoo Bear, and APT44, among other aliases. It is affiliated with the GRU (Russian military intelligence, Unit 74455) and is considered one of the Kremlin’s most dangerous and capable cyber units. Iridium has a long history of targeting Ukraine and other European countries, focusing on critical infrastructure, especially the energy sector, government, logistics, and telecommunications. Notable operations include the 2015 and 2016 Ukrainian power grid attacks (using BlackEnergy and later GreyEnergy malware), the NotPetya supply chain attack (via TeleBots), and ongoing destructive and espionage campaigns against Ukrainian and EU targets. Iridium employs a wide range of tactics, including spearphishing, exploitation of public-facing servers, living-off-the-land techniques, supply chain attacks, and deployment of custom malware (e.g., BlackEnergy, GreyEnergy, KillDisk, NotPetya, AcidRain, ZEROLOT). The group is known for destructive wiper malware, advanced persistence mechanisms (e.g., SSHBearDoor), and targeting of ICS/SCADA environments. Iridium often coordinates cyberattacks with kinetic operations, as seen in combined missile strikes and cyberattacks on Ukrainian energy infrastructure. The group is highly adaptive, using both custom and legitimate tools for stealth, and frequently updates its malware and TTPs. Sub-groups and related clusters include TeleBots and GreyEnergy. Iridium’s operations are characterized by high operational security, advanced targeting, and a focus on both sabotage and espionage.