SandCat

Linked to Uzbekistan by one source.

Reports: 13
Last reported: 6 April 2026
Known CVEs: 8
Origin: Uzbekistan

ID: sandcat
Sources: MISP ETDA Malpedia
Merge evidence: 2 alias matches

Reports per quarter

2018 Q4: 2 reports
2019 Q1: 2 reports
2019 Q2: 1 report
2019 Q3: no reports
2019 Q4: 3 reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: 1 report
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: 1 report
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 3 reports

Dated reports, 2018 Q4 to 2026 Q2.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Threat Groups SandCat, FruityArmor Exploiting Microsoft Win32k Flaw

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Groups SandCat, FruityArmor Exploiting Microsoft Win32k Flaw
6 April 2026

Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC
6 April 2026

APT trends report Q1 2019

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2019
11 December 2024

Lookout Discovers PlainGnome and Bonespy Uzbek Android spyware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lookout Discovers PlainGnome and Bonespy Uzbek Android spyware
21 December 2020

Red_Kangaroo

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Red_Kangaroo
4 December 2019

APT review: what the world’s threat actors got up to in 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review: what the world’s threat actors got up to in 2019
3 October 2019

Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC
3 October 2019

Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC
13 May 2019

APT_trends_report_Q1_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2019_Securelist
13 March 2019

The fourth horseman: CVE-2019-0797 vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The fourth horseman: CVE-2019-0797 vulnerability

Show all 13 reports Show fewer

13 March 2019

The fourth horseman- CVE-2019-0797 vulnerability

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The fourth horseman- CVE-2019-0797 vulnerability
12 December 2018

Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
12 December 2018

Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)

Newest first. Details opens the report in Explore.