CRITICALAi
Verified
Ukraine

Sandworm Deploys New Wiper Malware Against Ukrainian Energy Grid

·Source: CERT-UA / Mandiant

Updated:

Executive Summary

Russian GRU Sandworm group deploys new wiper variant AcidBurn targeting Ukrainian power distribution systems during winter heating season.

Analysis

Sandworm deployed AcidBurn wiper malware against three Ukrainian regional power distribution companies. The malware targets both IT systems and OT/ICS components, specifically Schneider Electric SCADA platforms. Attack timed to coincide with sub-zero temperatures. Ukrainian CERT and international partners contained the attack before widespread outages occurred.

Timeline

Discovered
Mar 15, 2026
Exploitation Detected
Mar 15, 2026
Published
Mar 16, 2026
Source Attribution

Originally published by CERT-UA / Mandiant on Mar 16, 2026. Verified by: CERT-UA, Mandiant, CISA.

Related Threats