Sandworm Team

The Sandworm Team, a threat actor associated with Russia's military intelligence-linked group, has demonstrated significant capabilities in developing custom malware to target Operational Technology (OT) and Industrial Control Systems (ICSs). Since at least 2015, the team has used the "BlackEnergy" malware for distributed denial of service (DDoS), espionage, and destructive attacks. A unique variant, BlackEnergy 3, reemerged in Ukraine in 2015, where the Sandworm Team was first identified. This malware has since become their signature tool, underscoring the potential threat they pose to US and European critical systems. In 2022, the Sandworm Team attempted to disrupt Ukrainian energy providers using the "Industroyer" (also known as CrashOverride) and "Caddy Wiper" malware. Furthermore, the Russian hacker group "Solntsepek," tied to the Sandworm Team, claimed responsibility for a cyber attack against Ukraine's largest telecommunications provider. The team has also managed to implant malware on thousands of WatchGuard firewall devices worldwide, demonstrating their widespread reach and sophisticated hacking abilities. The Sandworm Team is part of the Russian GRU Unit 74455, separate from other more established GRU-affiliated groups like Fancy Bear (APT28) and Forest Blizzard. The team is led by Evgenii Serebriakov, who authored a master’s thesis on "Information Confrontation in World Politics." The Sandworm Team is recognized as Russia’s leading cyber attack capability, having conducted complex attacks that caused electrical outages in Ukraine and the most expensive destructive attack in history: NotPetya. Their activities suggest an ongoing interest in targeting critical infrastructure globally.