GRU Unit 74455

Unit 74455 is a cyber operations unit of Russia's Main Intelligence Directorate (GRU), formally part of the Main Centre for Special Technologies (GTsST). In private-sector threat intelligence it is most commonly tracked under the names Sandworm, Voodoo Bear, BlackEnergy, Telebots, and Iron Viking. The unit is widely regarded as one of the most aggressive state-sponsored hacking groups, specializing in destructive ("wiper") malware and attacks on critical infrastructure rather than the quieter espionage tradecraft associated with GRU Unit 26165 (Fancy Bear / APT28).

In October 2020, the U.S. Department of Justice unsealed an indictment in the Western District of Pennsylvania charging six GRU officers assigned to Unit 74455 with a multi-year campaign of computer intrusions. The indictment attributed to the unit:

• The December 2015 and December 2016 attacks on the Ukrainian power grid, which caused blackouts affecting hundreds of thousands of customers.
• The 2017 NotPetya malware outbreak, which began in Ukrainian tax-accounting software and caused billions of dollars in global damage to firms including Maersk, Merck, and FedEx's TNT Express.
• Spearphishing and hack-and-leak operations targeting Emmanuel Macron's 2017 French presidential campaign (the "Macron leaks").
• Cyberattacks on the 2018 PyeongChang Winter Olympics opening ceremony, known as "Olympic Destroyer," with false-flag elements designed to implicate North Korea.
• Intrusions targeting investigators of the Skripal poisoning and the OPCW.

In 2020 the United Kingdom's NCSC publicly attributed the Olympics attack to the GRU. The EU Council imposed sanctions in July 2020 on Unit 74455 personnel under its cyber sanctions regime. Western governments cite the unit as a primary example of the blurring line between cyber operations and armed conflict, and its activities feature heavily in debates over applying international humanitarian law to cyberspace.