Sandworm is the name given by cybersecurity researchers to an advanced persistent threat (APT) group attributed to Unit 74455 of Russia's Main Intelligence Directorate (GRU), the military intelligence agency of the Russian Armed Forces. The group is also tracked under names including Voodoo Bear, Telebots, and Iron Viking. Unlike espionage-focused units, Sandworm is distinguished by its emphasis on destructive and disruptive operations rather than pure intelligence collection.
Sandworm is most closely associated with attacks against Ukraine. In December 2015, it carried out the first publicly confirmed cyberattack to cause a power outage, cutting electricity to roughly 230,000 customers in western Ukraine by compromising regional distribution operators. A second, more automated attack on Kyiv's grid followed in December 2016, using the Industroyer (also called CrashOverride) malware. In June 2017, Sandworm deployed NotPetya, a wiper disguised as ransomware, which spread globally via a compromised Ukrainian tax software update (M.E.Doc) and caused damages estimated by the White House at over $10 billion, affecting Maersk, Merck, FedEx's TNT Express, and others.
The group has also been linked to the 2018 Olympic Destroyer attack on the Pyeongchang Winter Olympics opening ceremony, intrusions into French election infrastructure in 2017, and disruptive operations against Georgian websites in 2019.
In October 2020, the U.S. Department of Justice indicted six GRU officers identified as Sandworm members, charging them with conspiracy to commit computer fraud, wire fraud, and damage to protected computers. The UK's National Cyber Security Centre and the EU have issued parallel attributions and sanctions.
Since Russia's full-scale invasion of Ukraine in February 2022, Sandworm has been linked to renewed wiper campaigns (HermeticWiper, CaddyWiper, Industroyer2) targeting Ukrainian government, telecom, and energy systems. The group is considered one of the most capable and aggressive state-aligned cyber actors operating today.
Example
In October 2020, the U.S. Department of Justice unsealed indictments against six GRU officers identified as members of Sandworm, charging them in connection with the NotPetya, Olympic Destroyer, and Ukrainian grid attacks.
Frequently asked questions
Western governments and researchers attribute Sandworm to Unit 74455 of Russia's GRU military intelligence service. The U.S. DOJ named six specific officers in a 2020 indictment.
Keep learning