Threat actor
threat_actor:sandworm
Also: GRU Unit 74455, Unit 74455
A Russian-speaking hacker group associated in the episode with attacks against Ukraine and with Russia’s military intelligence agency.
A Russian-speaking hacker group associated in the episode with attacks against Ukraine and with Russia’s military intelligence agency.
“Those attacks, in turn, had been tied to this group Sandworm.”
“Sandworm was Fancy Bear, APT28”
Russian hacking group identified in the episode as responsible for Olympic Destroyer, NotPetya, and attacks on Ukraine.
“This was the hacking group known as Sandworm.”
“Unit 74455 was Sandworm.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | POSSIBLY_SAME_AS | Fancy Bear | Uncertain | 54 |
| outgoing | ASSOCIATED_WITH | GRU | Uncertain | 54 |
| outgoing | ASSOCIATED_WITH | Unit 74455 | Attributed | 77 |
| incoming | ATTRIBUTED_TO | NotPetya | Attributed | 54 |
| incoming | ATTRIBUTED_TO | Olympic Destroyer | Attributed | 77 |
NotPetya ATTRIBUTED_TO Sandworm
ESET's forensic evidence tied NotPetya to earlier attacks against Ukraine that had been tied to Sandworm.
Attributed Confidence 91% · Andy Greenberg EP 54 Details
“ESET had started to pull together forensic evidence that tied NotPetya to the earlier waves of attacks against Ukraine”
“Those attacks, in turn, had been tied to this group Sandworm.”
Sandworm POSSIBLY_SAME_AS Fancy Bear
The episode presents Sandworm and Fancy Bear as possibly the same group, but explicitly says this is not known.
Uncertain Confidence 98% · Jack Rhysider EP 54 Details
“It might be the same group as Fancy Bear. We don’t know.”
The episode presents the belief that Sandworm and Fancy Bear were hacking groups working for Russia's GRU, while acknowledging uncertainty about the exact relationship.
Uncertain Confidence 85% · Jack Rhysider EP 54 Details
“what we believe is that both Sandworm and Fancy Bear are hacking groups both working for Russia’s GRU in Moscow.”
Olympic Destroyer ATTRIBUTED_TO Sandworm
The episode ultimately identifies Sandworm as the group responsible for the Olympic attack, while earlier forensic clues were deliberately deceptive.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“this was the same group that conducted NotPetya, one of the most extreme cyber-attacks the world has ever seen. This was the hacking group known as Sandworm.”
Sandworm ASSOCIATED_WITH Unit 74455
The episode says the Mueller Report identified Unit 74455 as Sandworm; this is presented as the working identification of the group.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“it was the first time we learned that Unit 74455 was Sandworm”