Russia Pivots Its Cyberthreats Back to the U.S. and the West

**Executive Summary:** Google Threat Intelligence Group and DomainTools warn that Russian-backed threat actors and pro-Russian hacktivists—including UNC5792, UNC4221, and Sandworm—are refocusing on Western targets, conducting Signal backup-recovery-key phishing against officials and journalists, expanding influence operations with generative AI and media mimicry, and collaborating with other nation-state actors (China, Iran) on pre-positioning and sabotage of water and wastewater systems.