Russian Sandworm hackers pose as hacktivists in water utility breaches

Mandiant attributes long-running destructive and espionage operations to Sandworm (APT44/GRU Unit 74455), reporting that the actor has used Telegram-based false 'hacktivist' personas to leak data, amplify narratives, and claim disruptive intrusions against Ukrainian and international critical infrastructure (including water utilities and power). The group employs phishing, credential theft, vulnerability exploitation, supply-chain compromise, and wiper malware, and is assessed to be actively collecting intelligence and likely to attempt political influence operations such as election interference.