Inside Sandworm: Decade of Cyber Sabotage and Espionage Activity

Sandworm is a long-running, highly capable GRU-linked APT that has executed strategic espionage and destructive cyber-sabotage operations since 2014 — from spearphishing and Office zero-days to supply-chain NotPetya and firmware-rooted Cyclops Blink — targeting Ukraine and NATO-aligned nations; the report consolidates major incidents, maps Sandworm tooling and behaviors (including wipers, ransomware, infostealers, firmware persistence and C2 techniques) to the MITRE ATT&CK framework, and provides example artifacts and mitigation/testing guidance.