# How Sandworm Learned to Think Like a Cybercriminal
Russia's GRU spent years building some of the most destructive malware ever deployed — NotPetya, Industroyer, Cyclops Blink. Now, a sub-cluster of that same unit is leaning on a trick that ransomware affiliates and phishing crews figured out months ago: convince targets to infect themselves.
Between June and July 2026, UAC-0145 — a team operating within Sandworm, the GRU hacking unit responsible for attacks on Ukrainian power grids and global shipping firms — compromised at least ten websites and laced them with fake CAPTCHA prompts. Visitors were told to paste a PowerShell command into their terminal to "verify" they were human. They weren't verifying anything. They were installing a multi-stage malware chain.
CERT-UA, Ukraine's computer emergency response team, published an alert this week detailing the campaign. The writeup is worth reading closely — not just for what it says about the tools deployed, but for what it reveals about how Sandworm is evolving its operational posture.
## The Fake CAPTCHA That Builds a Foothold
ClickFix has circulated in the threat landscape since at least early 2024. The premise is deceptively simple: exploit users' trust in CAPTCHA prompts, present a fake verification step, and have the target manually run malicious code. No exploit required. No zero-day budget needed.
What makes Sandworm's version notable is the infrastructure layered underneath it.
The attackers didn't just drop a malicious script on a site. They deployed SMARTAXE, a bespoke tool that dynamically rewrites page content based on who's visiting — meaning the CAPTCHA prompt only appears to qualifying targets. Traffic filtering via Cloaking.House, a commercial service designed to serve different content to different visitors, lets the group keep the payload hidden from automated scanners and researchers while surfacing it to the Ukrainians they're actually after.
There's also an EtherHiding component. Rather than hardcoding a domain for the next-stage payload, the attackers stored it in an Ethereum smart contract. The injected CAPTCHA script reads the contract address from the page source, queries the blockchain, and retrieves the current domain on the fly. Blockchain entries are immutable and don't go offline when an abuse team processes a takedown report — which is precisely the point. Traditional sinkholing doesn't work here.
## A Full Malware Stack With Deliberate Names
The payload chain CERT-UA recovered is layered in a way that suggests operational discipline:
This is not a smash-and-grab toolkit. It's a staged access chain designed to quietly establish persistence, validate the target is worth continuing against, and then deploy capability incrementally — the kind of tradecraft you expect from a unit whose institutional mandate is espionage, not financially-motivated ransomware.
## The Android Angle Nobody Is Talking About
The Windows campaign is getting most of the coverage. The Android campaign is more interesting.
Separately, UAC-0145 has been distributing APK files through messaging apps, disguising them as security utilities. Install one of these apps and you're running COWARDDUCK, a full-featured mobile backdoor that collects contacts, harvests files matching extensions like .ovpn, .conf, .json, .docx, and .xlsx from standard device directories, and tracks real-time geolocation.
The .ovpn target is the tell. VPN configuration files contain server addresses, certificates, and sometimes embedded credentials. They're the kind of artifact a signals intelligence unit wants when it's trying to map an adversary's secure communications infrastructure. This isn't about stealing documents — it's about learning how targets connect to their networks.
Exfiltration runs through Dropbox. Command and control runs through steamcommunity[.]com. Both are legitimate services with high traffic volumes and low suspicion. Blocking either at the perimeter creates collateral damage; allowlisting creates a free exfil channel. That's the trap defenders walk into.
## The Convergence Nobody Should Be Surprised By
Sandworm has historically relied on trojanized software installers and weaponized Office documents. The shift to ClickFix isn't an accident — it's an admission that the old delivery methods face increasing friction. Endpoint detection has gotten better at catching malicious macros and tampered installers. Trained users at Ukrainian government institutions are now more skeptical of unexpected file attachments.
Social engineering bypasses all of that. And ClickFix's particular brilliance is that the user executes the payload themselves — which means behavioral detection systems that watch for unusual child process spawning from Office applications or browsers see nothing out of the ordinary. The malicious PowerShell is launched from the terminal by the human, not by a compromised parent process.
Russia's intelligence services are watching what works in the criminal ecosystem and operationalizing it. That should inform how defenders think about these techniques — not as opportunistic crimeware that state actors are too sophisticated to bother with, but as a proven delivery mechanism that nation-state teams are actively evaluating and adopting.
---
## HackWire Analysis
The detail that deserves more attention in this story is EtherHiding. Most ClickFix coverage focuses on the social engineering vector — and rightly so, because it's where the human vulnerability lives. But the blockchain infrastructure component changes the defensive calculus in ways the current writeups don't adequately address.
When a threat actor embeds their next-stage domain in an Ethereum smart contract, traditional takedown requests stop working. Abuse teams can't deplatform a blockchain entry. Incident responders can't sinkhole it. The domain can change at any time without touching the compromised site. Defenders need network-level controls that catch the Ethereum RPC call being made from an unexpected context — not just blocklists of known malicious domains.
The Android campaign also deserves closer scrutiny from organizations with personnel in Ukraine or adjacent to Ukrainian government and military communications. .ovpn targeting means Sandworm is actively hunting network access credentials and VPN configuration details. Any organization that has issued VPN credentials to employees who may have Ukrainian personal or work devices should treat this as a live credential-threat scenario, not just a malware-delivery story.
The pattern here is Sandworm maturing its consumer-facing attack surface. They've always had the capability for destructive attacks. What they're building now is a persistent, quiet intelligence-collection pipeline — and that's a harder problem for defenders than a wiper that announces itself.
For Ukrainian targets: validate that CAPTCHA prompts on government-adjacent websites don't ask you to run anything in PowerShell or Terminal. Full stop. Any website that does is either compromised or malicious. For everyone else: the ClickFix technique is not Ukraine-specific. The criminal groups running the same playbook don't limit their targeting to any geography.
— HackWire Editorial
---
## Related Coverage