CERT-FR reports a campaign by the Sandworm intrusion set targeting Centreon systems primarily in Western Europe. The campaign exploits public-facing Linux applications to perform file discovery, deploy web shells, modify system processes, and exfiltrate data via command and control channels. Multiple threat actors including Iridium, Telebots, Sandworm, and Electrum are involved. The overall threat level is assessed as low by CERT-IST, with medium severity noted in the report. No patches are currently available for this threat.
