Most of the threat actors covered in this research library operate in the shadows for years, harvesting subscriber data, call detail records, and authentication vectors while carefully avoiding detection. Sandworm is different. This is not an espionage unit patiently building a collection pipeline — it is the Russian military group that turned off the lights in Ukraine three times, unleashed the most financially destructive malware in history, and treats telecommunications infrastructure not as a target to exploit quietly but as a switch to flip during active war.
Where Salt Typhoon and LightBasin-class actors optimize for persistence and stealth, Sandworm optimizes for effect. Its objective inside a telecom network is rarely to stay hidden indefinitely — it is to be in position, at the right moment, to sever communications, disable operational technology, and degrade a population's or a military's ability to coordinate. Understanding this actor means understanding what happens when a nation-state treats critical infrastructure sabotage as a legitimate instrument of war.
Sandworm (aliases: Voodoo Bear, IRIDIUM, MITRE ATT&CK G0034) is attributed to Russia's GRU Unit 74455 and has been active since at least 2009, publicly disclosed in 2014. It is classified as a destructive OT/critical infrastructure APT, first surfaced in force multiplier operations tied to the Ukraine conflict, with recurring multi-year campaigns against energy, telecom, and government targets across Ukraine and NATO states. This report covers its attribution, its documented destructive track record, its entry vectors and kill chain, its wiper/ICS toolset, and the standards gaps that keep OT and telecom infrastructure exposed to disruption during kinetic conflict.
I. Attribution: GRU Unit 74455 and the APT44 Designation
Sandworm — tracked by Microsoft as IRIDIUM and by MITRE ATT&CK as G0034, also known by the aliases Voodoo Bear and BlackEnergy Group — has been publicly and formally attributed to Unit 74455 of Russia's GRU (Main Intelligence Directorate). This is not an "assessed with moderate confidence" attribution common to many state actors profiled in our research library; it rests on US DOJ indictments, joint CISA advisories, and Mandiant's 2024 APT44 report, which explicitly names Sandworm as the unit responsible for operations spanning cyberespionage, information operations, and destructive attack.
First observed in 2009 and publicly disclosed in 2014, Sandworm's operational signature has remained consistent for over a decade: gain access through conventional means (phishing, supply chain, VPN exploitation), pivot from enterprise IT into operational technology, and — when the moment serves Russian strategic interests — execute a destructive payload rather than simply collect intelligence.
The Track Record
Sandworm's record of confirmed, publicly attributed destructive operations is unmatched by any other actor profiled on this site:
| Year | Operation | Impact |
|---|---|---|
| 2015 | Ukraine power grid attack | ~230,000 customers lost power; first confirmed cyberattack-caused blackout |
| 2016 | Kyiv substation attack (Industroyer/Crashoverride) | Second grid blackout; purpose-built ICS malware speaking IEC 60870-5-104 and IEC 61850 protocols natively |
| 2017 | NotPetya | Global self-propagating wiper disguised as ransomware; ~$10B in damages across Maersk, Merck, FedEx/TNT, and others — the most financially destructive cyberattack on record |
| 2022 | Whispergate + CaddyWiper | Wiper deployments against Ukrainian government and infrastructure ahead of and during the full-scale invasion |
This is not a hypothetical "what if a nation-state wanted to cause physical disruption" scenario. It is a documented, repeated operational pattern spanning nearly a decade, and telecom carriers sit directly inside the blast radius — both as a direct target and as collateral damage from wiper malware (like NotPetya) that does not discriminate by sector once it propagates.
II. Why Telecom Is a Force Multiplier Target
For espionage-motivated actors, telecom networks are valuable because they carry signaling metadata, subscriber location, and call content — see our analysis of SS7 signaling attacks for how that data gets extracted quietly. Sandworm's interest in telecom is different in kind, not just degree.
In a kinetic conflict, telecommunications infrastructure is a dual-use military target: it carries civilian traffic, but it also carries the coordination traffic of the defending military, emergency services, and government continuity-of-operations functions. Disabling or degrading a region's telecom backbone in coordination with a physical offensive is doctrinally equivalent to disabling its power grid or transportation network — it is classic combined-arms thinking applied to cyberspace.
Telecom operators need to internalize a threat model most enterprise security teams don't plan for: an adversary whose actual goal is denial of service to your entire subscriber base and backbone infrastructure, timed to coincide with events entirely outside your control (a border crossing, an offensive, a political deadline) — not data theft, not financial fraud, but outright disruption as a supporting fire for a physical operation.
III. Entry Vectors and Initial Access
Sandworm's initial access methods are, deliberately, unremarkable. The group does not rely on novel zero-days to get in the door — it relies on the same categories of weaknesses documented throughout this research library, then reserves its sophistication for what happens after.
| Vector | ATT&CK Technique | Notes |
|---|---|---|
| Spearphishing | T1566 (Phishing) | Targeted at infrastructure operators — energy, telecom, government personnel with privileged system access |
| Supply chain compromise | T1195 (Supply Chain Compromise) | Compromise of industrial/OT software vendors — the mechanism behind the initial NotPetya vector (a compromised Ukrainian tax software update, M.E.Doc) |
| VPN and perimeter exploitation | — | Consistent with broader GRU tradecraft; exploited alongside credential-based access into OT-adjacent networks |
The entry vector itself is rarely the interesting part of a Sandworm campaign. What distinguishes this actor is the movement layer: once inside enterprise IT, the objective is a deliberate pivot into OT systems and, where relevant, the telecom backbone — routers, transmission equipment, and network devices that carry both signaling and control traffic. This IT-to-OT pivot is exactly the kind of boundary that 5G SBA container and network segmentation failures demonstrate is chronically under-enforced across critical infrastructure operators generally, not just telecom.
IV. Kill Chain Walkthrough
Sandworm's kill chain looks conventional through the early phases and diverges sharply at "Actions on Objectives" — where most APTs in this series quietly collect, Sandworm destroys.
Phase 1 — Reconnaissance
Long-term reconnaissance of critical infrastructure, explicitly including telecom and energy sectors, with systematic mapping of OT/ICS systems. This phase can run for months or years before any offensive action — consistent with a strategic pre-positioning posture rather than an opportunistic smash-and-grab.
Phase 2 — Delivery
Spearphishing campaigns targeted at infrastructure operators (T1566), combined with supply chain compromise of industrial software vendors (T1195) — the same class of vector that delivered NotPetya via a trojanized accounting software update.
Phase 3 — Exploitation
Pivot from compromised enterprise IT into OT control systems. Sandworm favors legitimate credentials (T1078) over exploit chains at this stage — reusing harvested or default OT administrative accounts to reach industrial control interfaces rather than triggering new alerts with novel exploitation.
Phase 4 — Installation
This is where the ICS-specific tooling gets staged. Industroyer/Crashoverride — malware that speaks industrial protocols (IEC 60870-5-104, IEC 61850, OPC DA) natively — is deployed for grid-specific sabotage. BlackEnergy and VPNFilter provide persistence on network devices, including telecom routers, giving Sandworm a durable foothold on the exact infrastructure needed to disrupt communications later.
Phase 5 — Actions on Objectives: Destruction
The techniques mapped to this phase are blunt by design:
T1486— Data Encrypted for Impact: NotPetya's ransomware facade concealed a wiper — decryption was never actually possible, because destruction, not extortion, was the goal.T1561— Disk Wipe: CaddyWiper and Whispergate directly destroy disk structures on target systems ahead of and during the 2022 invasion, rendering infrastructure inoperable rather than merely inaccessible.T1489— Service Stop: Direct termination of services — including, in the Ukraine grid attacks, the deliberate manipulation of circuit breakers via Industroyer's protocol-native modules to physically de-energize substations.
V. Toolset
| Tool | Function |
|---|---|
| Industroyer (Crashoverride) | Purpose-built ICS malware speaking industrial protocols (IEC 60870-5-104, IEC 61850, OPC DA) natively; used to manipulate substation circuit breakers directly, causing the 2016 Kyiv blackout |
| BlackEnergy | Modular malware framework providing persistence and a foothold on network devices — including telecom routers — enabling the pivot from IT into OT |
| NotPetya | Self-propagating wiper disguised as ransomware; spread via EternalBlue/EternalRomance and a trojanized M.E.Doc software update; caused an estimated $10B in global damages |
| Whispergate | Wiper malware deployed against Ukrainian government and infrastructure systems in the lead-up to the 2022 invasion, disguised initially as ransomware |
| CaddyWiper | Destructive wiper deployed during the 2022 invasion, designed to destroy user data and partition information without the ransomware pretense of earlier tools |
Note the progression across the toolset: Industroyer and BlackEnergy are protocol-aware, purpose-built for OT/grid sabotage. NotPetya, Whispergate, and CaddyWiper are more generic destructive wipers — effective against any Windows-based enterprise IT environment, including telecom OSS/BSS and management systems, regardless of whether the target is "OT" in the strict sense.
ATT&CK Technique Mapping
| Technique ID | Name | Tactic |
|---|---|---|
| T1566 | Phishing | Initial Access |
| T1195 | Supply Chain Compromise | Initial Access |
| T1078 | Valid Accounts | Persistence |
| T1059 | Command and Scripting Interpreter | Execution |
| T1486 | Data Encrypted for Impact | Impact |
| T1561 | Disk Wipe | Impact |
| T1489 | Service Stop | Impact |
VI. The Standards Gap
Sandworm's persistent success is not a story of unstoppable zero-day capability — it is a story of insufficient OT/IT segmentation and telecom infrastructure that has never been hardened for wartime operating conditions. The same architectural weaknesses documented in our 5G SBA vulnerability research — flat network access, insufficiently segmented management planes, implicit trust between adjacent systems — apply directly to the enterprise-IT-to-OT pivot that defines this actor's methodology.
Most telecom operators architect their networks against espionage and fraud actors: data exfiltration, billing abuse, subscriber tracking. Very few have hardened their backbone routers, transmission equipment, and OSS/BSS systems against an actor whose objective is to render that infrastructure inoperable on a specific day for reasons entirely disconnected from the operator's own risk posture — the operator becomes a target because of where it sits, not because of anything it did.
VII. Defense and Mitigation
- Enforce strict OT/IT network segmentation. No flat trust path should exist between corporate IT (where phishing and supply-chain compromise land) and OT/ICS or telecom backbone management planes. Treat every segmentation boundary as if it will be tested by a wiper, not just an espionage implant.
- Harden and monitor telecom backbone routers as OT, not just IT. BlackEnergy/VPNFilter-class implants specifically target network infrastructure devices. Firmware integrity verification, out-of-band configuration backups, and anomaly detection on routers and switches are as critical as patching Windows servers.
- Maintain offline, immutable backups for OSS/BSS and core management systems. NotPetya-class wipers destroy disk structures outright; standard backup rotations connected to the same network are not sufficient protection.
- Plan for coordinated, multi-system disruption, not isolated incidents. Sandworm's historical pattern is simultaneous action across many systems timed to a trigger event. Incident response plans built around single-system compromise underestimate the blast radius this actor is capable of producing.
- Treat supply chain software updates — especially from vendors serving critical infrastructure — as a distinct threat surface. The NotPetya vector (a trojanized tax software update) remains the canonical case study for why vendor update integrity verification matters as much as endpoint detection.
This defensive posture complements, rather than replaces, the broader telecom penetration testing methodology TelcoSec recommends for evaluating operator security — but it requires explicitly scoping in destructive-impact scenarios, not just data-exfiltration scenarios, when assessing telecom OT and backbone infrastructure.
VIII. Authoritative References
- 01 CISA AdvisorySandworm Destructive Malware Targeting Ukraine (Jan 2022) Joint advisory detailing Whispergate and related destructive tooling deployed ahead of the 2022 invasion.
- 02 Mandiant — APT44: Unearthing Sandworm (Apr 2024) Mandiant APT44 Report → The definitive public attribution report tying Sandworm to GRU Unit 74455 and cataloguing its operational history from grid attacks through the 2022 invasion.
IX. Frequently Asked Questions
Yes. NotPetya — the self-propagating wiper disguised as ransomware that caused an estimated $10B in global damages in 2017 — is directly attributed to Sandworm, GRU Unit 74455. It remains the most financially destructive cyberattack publicly documented to date, and it is a core part of the evidentiary basis for the group's formal attribution.
In modern conflict, telecommunications and power are treated as equally critical for combined-arms disruption. Degrading a region's ability to communicate — for civilians, emergency services, and defending military units alike — is doctrinally as valuable as cutting power, and often easier to achieve given how much telecom infrastructure runs on commodity IT systems vulnerable to the same wiper malware used against enterprise networks generally.
Rarely. Its documented entry vectors — spearphishing, supply chain compromise, VPN exploitation — are conventional. Sandworm's distinguishing sophistication is not in initial access; it's in the purpose-built ICS malware (Industroyer) used once inside OT environments, and in the operational discipline to sit pre-positioned for months or years until a strategic trigger event.
Most telecom-focused APTs — signaling-plane actors exploiting SS7/Diameter, management-plane actors harvesting CDRs — are optimized to avoid detection indefinitely because their value is in ongoing collection. Sandworm's objective is disruption at a chosen moment, so its "actions on objectives" phase culminates in wiper deployment and service stop rather than continued quiet collection.
OT/IT network segmentation between corporate systems and backbone/management infrastructure, firmware integrity monitoring on routers and switches (BlackEnergy/VPNFilter specifically target network devices), offline immutable backups for OSS/BSS systems, and supply chain integrity verification for any vendor software touching critical infrastructure — modeled on the M.E.Doc compromise that delivered NotPetya.
Conclusion & Next Steps
Sandworm is the clearest public example of what happens when a nation-state fuses cyber capability with a wartime doctrine of infrastructure disruption. Its record — three grid blackouts, the costliest cyberattack in history, and repeated wiper deployments timed to a live invasion — is not a warning about a hypothetical future threat. It is a documented operational pattern that telecom operators near geopolitical flashpoints must actively plan around, not merely acknowledge in a risk register.
The defense roadmap for operators assessing exposure to this class of actor:
- Immediate: Audit OT/IT segmentation boundaries and firmware integrity monitoring on backbone routers and switches.
- Short-term: Verify offline, immutable backup coverage for OSS/BSS and core management systems.
- Medium-term: Extend supply chain integrity verification to all vendors with access to critical infrastructure systems.
- Ongoing: Incorporate destructive-impact scenarios — not just data exfiltration — into telecom penetration testing engagements for operators in or adjacent to active conflict regions.
