CRITICALMalware
Verified
Ukraine
Sandworm Deploys New Wiper Malware Against Ukrainian Energy Grid
Monday, March 16, 2026 at 07:00 AM UTC·Source: CERT-UA / Mandiant
Updated: Tuesday, March 17, 2026 at 12:00 PM UTC
Executive Summary
Russian GRU Sandworm group deploys new wiper variant AcidBurn targeting Ukrainian power distribution systems during winter heating season.
Analysis
Sandworm deployed AcidBurn wiper malware against three Ukrainian regional power distribution companies. The malware targets both IT systems and OT/ICS components, specifically Schneider Electric SCADA platforms. Attack timed to coincide with sub-zero temperatures. Ukrainian CERT and international partners contained the attack before widespread outages occurred.
Timeline
Discovered
Mar 15, 2026
Exploitation Detected
Mar 15, 2026
Published
Mar 16, 2026