Cybersecurity

Sandworm

Sandworm (APT44 / Seashell Blizzard, GRU Unit 74455) adversary-emulation playbook — IT→OT intrusion ending in ICS manipulation or destructive impact, executed with living-off-the-land Windows tooling. SAFETY-CRITICAL: destructive and ICS-write steps are canary/lab-only and gated on explicit OT authorization. Use when emulating Sandworm against an ICS/OT or critical-infrastructure estate. Triggers on: 'emulate Sandworm', 'APT44', 'Seashell Blizzard', 'Voodoo Bear', 'ICS attack', 'OT destructive', 'Industroyer', 'NotPetya'.

Publisher / source

BitterSecurity/Decepticon (found on GitHub top repositories)

Upstream record

BitterSecurity/Decepticon

Version

Version 1

Published

2026-11-04

Publication review

Approved for publication · recorded passed scan 2026-11-04

Content fingerprint

0a92335d85d77669bf1fa2c08bb7e1ca5dfa72f44b6de1a325c0fc2cde14b2b0