INTEL_REPORT
The Record (Recorded Future News) · published 7/16/2026, 1:50:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Sandworm hackers have a CAPTCHA trick for Ukrainians Rather than verifying they are human, the CAPTCHA users are instructed to copy and paste a PowerShell command into their Windows computers. Sandworm hackers have a CAPTCHA trick for Ukrainians | The Record from Recorded Future News Leadership Cybercrime Nation-state Influence Operations Technology Cyber Daily® Click Here Podcast Go Subscribe to The Record ✉️ Free Newsletter Image: Planet Volumes via Unsplash Daryna Antoni…
https://therecord.media/ukraine-sandworm-hacks-captcha-powershell
sha256:e8ccca1aaed0d704d71ea73b5434b1170adc0f49890da73ae64760184abd5673
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
| Type | Value | Link |
|---|---|---|
| domain | well.the | Open → |
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.