Sandworm

Sandworm is a Russian state-sponsored threat actor widely linked to the GRU, most commonly identified with Unit 74455. It is one of the most prominent Russian offensive cyber operators and is known for combining espionage, disruptive, destructive, and cyber-physical operations in support of Russian strategic and military objectives, especially against Ukraine and other European targets. Common aliases include APT44, Sandworm Team, Seashell Blizzard, TeleBots, Electrum, IRIDIUM, Voodoo Bear, Blue Echidna, Iron Viking, Quedagh, BE2, BlackEnergy, and Unit 74455. Sandworm has a long record of high-impact operations against critical infrastructure, government, telecommunications, and private-sector organizations. It is strongly associated with attacks on the Ukrainian power sector, including the 2015 Ukraine Electric Power Attack, and with later wartime disruptive activity against Ukrainian energy and telecom environments. The group is also broadly associated with destructive malware and wiper operations, including activity tied to CaddyWiper and reporting that linked it to attempted deployment of DynoWiper in attacks on Polish power-grid organizations. Sandworm was also publicly tied to the Viasat KA-SAT satellite network attack at the outset of Russia’s full-scale invasion of Ukraine. The group is especially notorious for the 2017 NotPetya operation, a destructive supply-chain attack in which operators compromised the update mechanism of Ukrainian accounting software to distribute malware that masqueraded as ransomware but functioned as a wiper. That campaign caused massive global collateral damage and remains a canonical example of state-directed destructive cyber activity spilling far beyond the intended theater. Operationally, Sandworm is assessed as a mature GRU actor that integrates network intrusion, malware deployment, destructive effects, and influence or deception elements. Reporting characterizes it as a central Russian destructive cyber-physical actor, particularly in the Russia-Ukraine conflict. The group has been observed using techniques such as process injection, system information discovery, registry modification, and web-shell deployment, and has historically used malware families and tooling associated with BlackEnergy-era operations as well as later wipers and bespoke intrusion capabilities. Sandworm has also been linked to efforts to lower host defenses or alter system settings prior to payload execution, including registry-based changes during the 2015 Ukraine power attack. It has used backdoors to enumerate victim operating-system details and has demonstrated the ability to conduct coordinated attacks against operational technology and enterprise environments alike. Some reporting notes operational relationships between Sandworm and pro-Russian hacktivist or proxy ecosystems, including loose or indirect links to CyberArmy of Russia Reborn. Such relationships are best understood as adjacent or cooperative rather than evidence that those groups are synonymous with Sandworm itself. High-confidence attribution supports Sandworm as a GRU-linked actor centered on disruptive and destructive operations, with Ukraine and critical infrastructure remaining among its most significant target sets.