Sandworm doesn't steal data. Sandworm destroys infrastructure. They caused the first confirmed cyber-attack on a power grid (Ukraine, 2015), the most expensive cyber-attack in history (NotPetya, 2017, $10B+ in damages), and the first ICS-protocol-level attack on electrical substations (Industroyer, 2016 and 2022). Since February 2022, they have deployed at least seven distinct wiper families against Ukrainian targets, coordinated with Russian military kinetic strikes.

Mandiant elevated Sandworm to APT44 in April 2024, recognizing it as one of the most capable and dangerous cyber actors globally. Their ICS expertise is unmatched: Industroyer/CRASHOVERRIDE communicates directly with grid equipment using IEC 61850, IEC 104, OPC DA, and Modbus protocols. No other threat actor has demonstrated this level of industrial protocol fluency in offensive operations.

2015: BlackEnergy against Ukrainian power companies. First confirmed cyber-caused power outage. Manual switching required to restore service.
2016: Industroyer/CRASHOVERRIDE against Ukrainian transmission substations. Automated ICS protocol manipulation. Power cut lasted approximately one hour.
2017: NotPetya. Supply chain attack via M.E.Doc accounting software update. Wiper disguised as ransomware. $10B+ global damages. Maersk, Merck, FedEx, hospitals, and hundreds of other organizations affected worldwide.
2018: Olympic Destroyer against PyeongChang Winter Olympics. Sophisticated false flag designed to implicate other APTs. Disrupted Wi-Fi, ticketing, and broadcasting.
2022: Wave of wipers at the start of the Ukraine invasion: WhisperGate (MBR corruptor + file wiper), HermeticWiper (EaseUS driver for disk-level destruction), CaddyWiper (file overwrite + partition table destruction), IsaacWiper, and Industroyer2 against electrical substations (thwarted by defenders).
2023: Infamous Chisel (Android malware targeting Ukrainian military devices). AcidPour (Linux wiper targeting embedded devices and routers).
2024-2025: ZeroLot wiper against Ukrainian energy companies. CERT-UA confirmed Sandworm sub-cluster compromised ICS for water, heat, and energy supply facilities to amplify the effect of missile strikes. KAMACITE expanded targeting into European OT supply chain (GIE conference targeting, 25+ Ukrainian industrial suppliers) and conducted sustained US ICS reconnaissance of Schneider Electric VFDs, HMIs, and Sierra Wireless Airlink gateways from March through July 2025.
May 2025: ELECTRUM coordinated destructive attacks against eight Ukrainian ISPs (Interlink, ActiveNet, Corbina, and others) using the Solntsepek hacktivist persona as cover. PathWiper identified: overwrites MBR and NTFS metadata, enumerates mounted volumes, targets all accessible storage for irreversible data loss.
December 2025: ELECTRUM expanded beyond Ukraine into Poland. First major cyberattack against distributed energy resources (DERs), targeting combined heat and power (CHP) facilities and renewable energy management systems. Polish authorities assessed the activity originated from actors linked to Russian state services. "The first major coordinated cyberattack against DERs anywhere in the world." Another new destructive wiper variant identified the same month.

1. 1. Check for GPO modifications you didn't make Sandworm's preferred deployment mechanism for wipers is Group Policy. CaddyWiper was deployed domain-wide through GPO-based scheduled tasks. The POWERGAP PowerShell script enumerates and modifies GPOs. Any GPO change outside a change window, especially ones adding scheduled tasks or startup scripts, should trigger immediate investigation. HOST: Persistence · Security EID 5136/5137 (GPO changes) · SYSVOL monitoring
2. 2. Hunt for wiper indicators before they execute Search for known wiper file hashes, process names, and artifacts across all hosts. HermeticWiper loads empntdrv.sys (a legitimate but abused EaseUS driver). CaddyWiper creates files in C:\Users\Public. WhisperGate stage1 overwrites the MBR. Sysmon EID 6 (DriverLoad) for unsigned or unexpected drivers. Sysmon EID 9 (RawAccessRead) for PhysicalDrive access. HOST: T1561.002 Disk Wipe · T1485 Data Destruction
3. 3. Check for shadow copy deletion and recovery disabling vssadmin delete shadows, bcdedit /set recoveryenabled no, wbadmin delete catalog. Sandworm executes these before deploying wipers to eliminate recovery options. Multiple recovery-inhibiting commands in sequence is near-certain destructive staging. HOST: T1490 Inhibit System Recovery
4. 4. Monitor ICS protocol traffic for unauthorized commands Industroyer communicates directly with grid equipment. Monitor Modbus (TCP 502) for unauthorized write commands, IEC 104 (TCP 2404) for control commands from non-SCADA sources, and OPC DA for unauthorized access. Any ICS protocol command from an IP that is not an authorized engineering workstation is critical. NET: Zeek/Suricata ICS protocol parsers · Air-Gapped OT playbook
5. 5. Audit edge devices and network appliances Cyclops Blink targeted WatchGuard and ASUS routers. VPNFilter targeted SOHO routers and NAS devices. Check firmware versions, look for unauthorized configuration changes, and verify device integrity against known-good baselines. Sandworm uses edge devices for persistent C2 and as pivot points into internal networks. NET: C2 · Vendor firmware integrity tools
6. 6. Search for service modification as persistence Industroyer persists by modifying an existing non-critical Windows service, replacing its ImagePath registry value with the path to the backdoor binary. Search for: services with recently changed ImagePath values, services pointing to binaries in unusual locations, and services with mismatched display names and binary paths. HOST: Persistence · HOST: Privilege Escalation (T1574.011)
7. 7. Check for lateral movement via domain infrastructure Sandworm uses domain admin credentials and GPO deployment for lateral movement. Map all privileged session activity: which accounts logged into which hosts, which GPOs were modified, which scheduled tasks were created. The pattern is: compromise the DC, deploy the wiper via GPO, and execute on a schedule. HOST: Lateral Movement · T1003.006 DCSync
8. 8. Look for Linux wipers on embedded/IoT devices AcidPour/AcidRain target Linux-based embedded systems (routers, modems, IoT devices). If you operate Viasat terminals, industrial Linux boxes, or network appliances, check for: unusual disk activity patterns, firmware integrity failures, and devices that have gone offline unexpectedly. AcidRain disabled 5,800 Viasat KA-SAT modems in February 2022. HOST: T1485 Data Destruction · Device firmware validation
9. 9. Verify supply chain software integrity NotPetya was distributed through a compromised M.E.Doc software update. Verify the integrity of all software update channels, especially industry-specific or regional applications. Check software signing, compare update hashes against vendor-published values, and monitor for unexpected update activity outside scheduled maintenance. HOST: Execution · Software update audit logs
10. 10. Activate continuity of operations plan If Sandworm indicators are confirmed, assume destructive action is imminent or already in progress. Isolate affected network segments. Switch to manual operations for ICS/SCADA (if applicable). Verify backup integrity (offline backups only). Notify CISA and relevant sector ISAC. The investigation continues from isolated systems, not live ones.

Destruction, not espionage. APT28 and APT29 collect intelligence. Sandworm destroys infrastructure. Their operations are designed to cause physical-world impact: power outages, logistics disruption, communications denial, and economic damage. The intelligence value is secondary to the destructive effect.

ICS protocol expertise. No other threat actor has demonstrated the ability to craft custom malware that communicates natively with industrial control systems using IEC 61850, IEC 104, OPC DA, and Modbus. Industroyer is not a modified IT tool: it is purpose-built ICS attack software.

A new wiper for every campaign. Most actors reuse tools. Sandworm develops new wiper families for each operational phase: CaddyWiper, HermeticWiper, WhisperGate, AcidPour, ZeroLot, PathWiper, plus an unnamed December 2025 variant. This makes signature-based detection of "the next wiper" impossible. Detection must be behavioral: mass file overwrites, raw disk access, partition table manipulation, GPO-deployed scheduled tasks.

Paired operations model: KAMACITE builds access, ELECTRUM executes. Sandworm operates as two coordinated teams (Dragos designations). KAMACITE handles initial access, credential theft, supply chain compromise, and reconnaissance. ELECTRUM handles destructive payloads and ICS-specific operations. In 2025, KAMACITE expanded from Ukrainian targets into the European OT supply chain and then pivoted to sustained US ICS reconnaissance (March-July 2025), scanning Schneider Electric Altivar VFDs, Smart HMIs, Accuenergy AXM modules, and Sierra Wireless Airlink gateways in a sequence designed to map entire control loops: where commands originate, how they propagate, and where physical effects could be induced.

Coordination with kinetic operations. Since February 2022, Sandworm has timed wiper deployments to coincide with Russian missile strikes on Ukrainian infrastructure. CERT-UA confirmed that compromised ICS access to water, heat, and energy facilities was intended to amplify missile strike effects. This is integrated military operations where cyber effects are synchronized with physical attacks.

Mandiant APT44 report (April 2024): Comprehensive Sandworm profile and formal APT designation.
CERT-UA: ICS compromise for infrastructure disruption (March 2024): Sandworm sub-cluster targeting water, heat, and energy ICS to amplify missile strikes.
ESET Industroyer2 analysis (April 2022): Thwarted ICS attack on Ukrainian energy substations.
US-CERT TA17-163A (June 2017): CrashOverride/Industroyer technical analysis.
DOJ indictment (October 2020): Six GRU officers from Unit 74455 indicted for NotPetya, Olympic Destroyer, and other destructive campaigns.

Air-Gapped OT / ICS (the environment Sandworm targets for physical-world impact)
Ransomware Detected (NotPetya was disguised as ransomware; distinguishing wipers from ransomware is critical)
APT28 / Fancy Bear (same GRU, different unit and mission: espionage vs destruction)
Volt Typhoon (China's infrastructure pre-positioning actor: similar targets, opposite operational style)