Sandworm (hacker group)

Sandworm also known as Unit 74455, is allegedly a Russian cybermilitary unit of the GRU, the organization in charge of Russian military intelligence.[1] Other names, given by cybersecurity researchers, include Telebots, Voodoo Bear, and Iron Viking.[2]

The team is believed to be behind the December 2015 Ukraine power grid cyberattack,[3][4][5] the 2017 cyberattacks on Ukraine using the NotPetya malware,[6] various interference efforts in the 2017 French presidential election,[2] and the cyberattack on the 2018 Winter Olympics opening ceremony.[7][8] Then-United States Attorney for the Western District of Pennsylvania Scott Brady described the group's cyber campaign as "representing the most destructive and costly cyber-attacks in history."[2]

On October 19, 2020 a US-based grand jury released an indictment charging six alleged Unit 74455 officers with cybercrimes.[9][10][11] The officers, Yuriy Sergeyevich Andrienko (Юрий Сергеевич Андриенко), Sergey Vladimirovich Detistov (Сергей Владимирович Детистов), Pavel Valeryevich Frolov (Павел Валерьевич Фролов), Anatoliy Sergeyevich Kovalev (Анатолий Сергеевич Ковалев), Artem Valeryevich Ochichenko (Артем Валерьевич Очиченко), and Petr Nikolayevich Pliskin (Петр Николаевич Плискин), were all individually charged with conspiracy to conduct computer fraud and abuse, conspiracy to commit wire fraud, wire fraud, damaging protected computers, and aggravated identity theft. Five of the six were accused of overtly developing hacking tools, while Ochichenko was accused of participating in spearphishing attacks against the 2018 Winter Olympics and conducting technical reconnaissance on and attempting to hack the official domain of the Parliament of Georgia.[2]

In February 2022, Sandworm allegedly released the Cyclops Blink as malware. The malware is similar to VPNFilter.[12] The malware allows a botnet to be constructed, and affects Asus routers and WatchGuard Firebox and XTM appliances. CISA issued a warning about this malware.[13]

In April 2022, Sandworm attempted a blackout in Ukraine.[14] It is said to be the first attack in five years to use an Industroyer malware variant called Industroyer2.[15]