CRITICALMalware
Verified
Ukraine

Sandworm Deploys New Wiper Malware Against Ukrainian Energy Grid

Monday, March 16, 2026 at 07:00 AM UTC·Source: CERT-UA / Mandiant

Updated: Tuesday, March 17, 2026 at 12:00 PM UTC

Executive Summary

Russian GRU Sandworm group deploys new wiper variant AcidBurn targeting Ukrainian power distribution systems during winter heating season.

Analysis

Sandworm deployed AcidBurn wiper malware against three Ukrainian regional power distribution companies. The malware targets both IT systems and OT/ICS components, specifically Schneider Electric SCADA platforms. Attack timed to coincide with sub-zero temperatures. Ukrainian CERT and international partners contained the attack before widespread outages occurred.

Timeline

Discovered
Mar 15, 2026
Exploitation Detected
Mar 15, 2026
Published
Mar 16, 2026
Source Attribution

Originally published by CERT-UA / Mandiant on Mar 16, 2026. Verified by: CERT-UA, Mandiant, CISA.

Related Threats