Case gtig-sandworm-relic-geminiState actor AI opsUkraine
Sandworm-linked cluster used Gemini to write password-spraying scripts against Ukraine
GTIG reported a cluster it tracks as SANDWORM RELIC, tied to APT44, integrating Gemini to write and refine asynchronous Python password-spraying tools and Bash automation in operations against Ukraine.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 8, 2026
- Location
- Ukraine
- Target
- Ukrainian organisations
- Severity
- High
- Triggered by
- SANDWORM RELIC / APT44 (Russia GRU)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
GTIG reported a cluster it tracks as SANDWORM RELIC, tied to APT44, integrating Gemini to write and refine asynchronous Python password-spraying tools and Bash automation in operations against Ukraine.
Impact: Faster credential attacks on Ukrainian targets; compromises not quantified.
Who triggered it
Actor: SANDWORM RELIC / APT44 (Russia GRU)
Attribution: GTIG links the cluster to Sandworm (FROZENBARENTS, APT44); press summaries relay the attribution.
Motive: Espionage and disruption against Ukraine
How it happened
Attack vector: LLM-assisted credential-attack tooling
Root cause: Scripting help is hard to refuse without context of the operator
Timeline
- Q2 2026 activity window in which Gemini-assisted scripting was observed
- GTIG publishes the finding and disables related assets
Response
Assets disabled, classifiers strengthened.
Current status: Ongoing
Sources (open in a new tab)
- GTIG From Prompting to Autonomy cloud.google.com
- Cyber Magazine coverage cybermagazine.com
- Hendry Adrian mirror hendryadrian.com
Cite this case
Sandworm-linked cluster used Gemini to write password-spraying scripts against Ukraine. AI Threat Watch, case gtig-sandworm-relic-gemini, Sep 8, 2026. https://aithreat.io/cases/gtig-sandworm-relic-gemini/
Permanent link: https://aithreat.io/cases/gtig-sandworm-relic-gemini/