Researchers: Sandworm escalates inside industrial networks it has already entered
May 14, 2026
Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.
Why it matters
Spotting an intruder is not the end of an intrusion. This group appears to rely on access it already has rather than on new vulnerabilities.
What defenders can take from it
- Protect engineering workstations and operator screens as closely as the controllers themselves.
- Assume an intruder detected in IT may already be in OT, and plan the response for both.