'Sandworm' Group Is Russia's Primary Cyberattack Unit in Ukraine

Mandiant attributes a broad, highly capable Russian GRU-linked actor known as Sandworm (APT44) with sustained espionage and destructive operations since 2022 — including attacks on Ukraine's infrastructure, the NotPetya outbreak, ransomware targeting a NATO-country logistics provider, and demonstrations against water/hydroelectric facilities — noting the group's global targeting, exploitation of edge devices and living‑off‑the‑land techniques, and use of front personas (e.g., CyberArmyofRussia_Reborn) to advance Russian military and political objectives.