The Sandworm hacking group, a threat actor with strong ties to Russia’s Main Intelligence Directorate (GRU), and previously known as BlackEnergy, Seashell Blizzard, or Voodoo Bear, is now being tracked as APT44 due to the group’s highly adaptive nature and significant concern for risks they pose to governments and critical infrastructure organizations around the world. APT44 has been leveraging sophisticated cyber tactics to conduct espionage, sabotage, and influence operations on a global scale for a decade and a half. Active since at least 2009, this group has evolved its strategies over time, but their true strength has been particularly highlighted in the wake of Russia’s invasion of Ukraine, showcasing their ability to support Russia’s military campaign with cyber warfare capabilities. APT44 has adeptly used online personas and Telegram channels, such as XakNet Team, CyberArmyofRussia_Reborn, and Solntsepek, to obfuscate its activities, posing as independent hacktivist groups while conducting operations that align with Russia’s strategic interests. These platforms have been instrumental in leaking sensitive information, claiming responsibility for cyberattacks, and spreading narratives favorable to Russia, effectively blurring the lines between state-sponsored activities and grassroots hacktivism. The group’s cyber operations have been wide-ranging and impactful, targeting not only Ukraine with data-wiping malware and other destructive attacks, but also targeting NATO countries’ electoral systems and critical infrastructure across the US and Europe. APT44 has been linked to significant cyber incidents in the past, such as the deployment of NotPetya malware, the WannaCry ransomware attack, and disruptions to water utility infrastructure, including a recent overflow event in Texas. Recent reports underscore the adaptability and sophistication of APT44, highlighting their role in shaping Russia’s cyber offensive capabilities. The group’s continued focus on Ukraine, coupled with its targeting of countries where Russian interests intersect, signifies a persistent and severe threat to global security.