S is for Sandworm — The Soldiers Who Turned Off the Lights

The Alphabet of Actors — Letter S. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED, ARRESTED, WEAPONIZED.

Every actor in this register so far has attacked something made of information — stolen data, encrypted files, surveilled a phone, defrauded a bank. Their harm, however grave, stayed inside the machine. Sandworm is the letter where the harm walked out of the machine and into the physical world. On a December night in 2015, in the cold of a Ukrainian winter, roughly a quarter of a million people lost electricity — not because a storm downed a line, but because a foreign country's military reached through the internet, opened the breakers at their power company, and switched them off. It was the first time in history a cyberattack turned off the lights. Sandworm did that, and it was only getting started.

Sandworm is Russia's GRU Unit 74455 — a formal unit of the Russian military's Main Intelligence Directorate, tracked by researchers as Sandworm Team, Voodoo Bear, Telebots, and Iridium. It is important to say what that means, because it separates this letter from most of the register: Sandworm is not a criminal gang the state tolerates, and not a deniable contractor. It is soldiers. Its members are serving military officers, and in 2020 the United States named six of them in an indictment, charging them with the worldwide deployment of destructive malware. The list of what those soldiers built and fired reads like the darkest chapter of the young history of cyberwar: the malware that blacked out Ukraine, the malware that sabotaged the Olympics, and NotPetya — the single most destructive and costly cyberattack that has ever happened.

This is the letter about the moment cyberattacks became physical, about the one weapon in this whole alphabet whose damage is measured not in dollars or records but in darkness and in a $10 billion global scar, and about an actor that, far from being deterred by being named, went on to fire its cyberweapons alongside actual missiles in an actual war.

1. The Actor: soldiers, not criminals

The single most important fact about Sandworm is the one hiding in its official designation, and the letter has to establish it first because it changes the category of everything that follows. Sandworm is GRU Unit 74455. The GRU is Russian military intelligence. A "unit" with a number is not a metaphor for a loose crew; it is a formation of the armed forces, with officers, a chain of command, and a mission assigned by the state. When Sandworm attacks, it is not organized crime operating from a country that looks the other way. It is a military conducting operations.

That distinction matters enormously, and it is worth being precise about why. Elsewhere in this register the recurring theme has been deniability — the ransomware crew the Kremlin tolerates but does not command, the spyware vendor that blames its government customers, the front company that lets a state disown its hackers. Deniability is a shield, and most state-aligned cyber actors cling to it. Sandworm's attacks were deniable in the moment, and Russia denied them, but the truth underneath was never a gang. It was a government's soldiers, and the 2020 United States indictment made that explicit by naming six of them as GRU officers of Unit 74455 and charging them with building and deploying the destructive malware catalogued in this letter.

Read that as an escalation in kind, not just degree. When a criminal gang blacks out a city, it is a crime, however grave. When a nation's military blacks out another nation's city, it is closer to an act of war — a use of state force against another state's civilian infrastructure. Sandworm is the point in this alphabet where the actor stops being a criminal problem and becomes a military one, where the appropriate frame shifts from law enforcement to armed conflict. Everything destructive it did, it did in uniform, and that uniform is why this letter's stakes are the highest in the register.

2. The Lights: the first blackout caused by hacking

Sandworm's defining achievement — if that is the word for it — is that it proved a thing many had feared and none had confirmed: that a cyberattack could reach off the screen and turn off the physical world. This section states the two grid attacks plainly, because they are the threshold the whole letter turns on.

In December 2015, Sandworm attacked the systems of Ukrainian electricity distribution companies. Using the BlackEnergy malware to gain and hold access, and the KillDisk wiper to destroy systems on the way out, the operators did something no cyberattack had ever publicly done: they remotely operated the utility's own controls, opening the circuit breakers that carry power to homes, and cut electricity to roughly 230,000 people. Then, to slow the recovery, they wiped the control systems and disabled backup power, forcing utility workers to drive out and restore the breakers by hand, in the dark, in winter. A year later, in December 2016, Sandworm did it again to Kyiv, this time with Industroyer — also called CrashOverride — malware purpose-built to speak the industrial protocols that electrical substations use, engineered from the ground up for the specific job of tripping a power grid.

Sit with the significance, because it is a genuine historical threshold and not a rhetorical one. Before December 2015, the blackout-by-hacking was a hypothetical — the thing security experts warned about and skeptics dismissed as scaremongering. After December 2015, it was a documented event with a date, a victim count, and a named perpetrator. Sandworm converted a fear into a precedent. And Industroyer raised the stakes further: BlackEnergy was general-purpose malware turned against a grid, but Industroyer was a weapon designed for grids specifically, a reusable tool for turning off electricity. Someone had now built, and used, malware whose entire purpose was to darken cities. The lights that went out in Ukraine were real, the cold was real, and the line between cyberattack and physical sabotage — the line that had held until that night — was gone.

3. NotPetya: the weapon that could not be contained

If the grid attacks are Sandworm's threshold, NotPetya is its masterpiece of destruction and the most important single event in the register, because it taught the world a lesson about cyberweapons that nothing else has taught so completely: they do not stay where you aim them.

In June 2017, Sandworm seeded its malware into an update for M.E.Doc — a piece of accounting software so widely used in Ukraine that almost every company doing business there ran it. When the tainted update went out, the malware went with it, into the heart of Ukrainian commerce. It then spread on its own, using the leaked EternalBlue exploit and stolen credentials to worm from machine to machine across networks. It looked like ransomware — it displayed a ransom note demanding Bitcoin — but that was a costume. NotPetya was a wiper. It destroyed the data it touched, with no real key and no real recovery; the ransom demand was theater over a bonfire.

And then it escaped. NotPetya was aimed at Ukraine, but a destructive worm does not respect a border, and it tore outward across the connected world. It crippled Maersk, the shipping giant that moves a large fraction of global trade, freezing terminals and forcing the company to rebuild its entire network. It hit Merck, the pharmaceutical company, disrupting production. It struck FedEx's TNT division, Mondelez, Saint-Gobain, Reckitt, and — this is the part that must not be lost — hospitals, whose systems went down in the blast radius of a weapon that had nothing to do with them. The total damage is estimated around ten billion dollars, which makes NotPetya the most costly cyberattack in recorded history. Read that number as the price of a single lesson: a destructive cyberweapon cannot be geographically contained. Sandworm fired it at one country, and it burned everyone it could reach, on every continent, because that is what a worm does. The companies in Copenhagen and New Jersey and everywhere else were collateral — casualties of a Russian military operation against Ukraine that they happened to be networked to. NotPetya is the reason "we only aimed it at them" is not a defense anyone should ever accept about a self-spreading weapon.

4. The False Flag and the War

Two more chapters complete the portrait, because they show what Sandworm does when it wants to hide, and what it does when it stops hiding entirely.

The hiding is Olympic Destroyer. At the 2018 Winter Olympics in Pyeongchang, Sandworm sabotaged the opening ceremony's IT systems — and, as the indictment notes in its reference to a "false flag" operation, it engineered the malware to deceive the investigators who would examine it. Olympic Destroyer was salted with misleading forensic indicators, including fingerprints associated with North Korea's Lazarus Group, so that the first analysts to look would blame the wrong country. This is a crucial thing to understand about Sandworm and about attribution generally: a sophisticated actor does not merely cover its tracks, it lays false ones, deliberately poisoning the evidence to send investigators chasing an innocent party. It is the reason careful attribution insists on multiple independent sources and treats a single convenient fingerprint with suspicion — because the fingerprint may have been planted precisely to be found.

The not-hiding is the war. In February 2022, Russia invaded Ukraine with tanks and missiles, and Sandworm's cyberweapons went in alongside them. The unit deployed Industroyer2 — an updated version of its grid-killing malware — against Ukrainian electrical infrastructure, and unleashed a family of wipers, including CaddyWiper, to destroy data as the physical assault unfolded. The pretense was gone. There was no longer any question of deniable proxies or criminal cover; this was a military unit conducting cyberattacks as one component of its country's open, declared war. The lights Sandworm had learned to turn off in 2015 were now a targeting option in a full-scale invasion, and the destruction it had rehearsed for years was integrated into an army's operations. This is the trajectory that gives the letter its verdict: not an actor deterred or contained, but one that graduated from covert sabotage to open warfare, firing its code beside artillery.

5. Named, and Beyond Reach — but that is not the point

The register's recurring question is what consequence an actor faced, and Sandworm was, formally, held to account: in October 2020 the United States indicted six named officers of GRU Unit 74455 for this catalogue of destruction. So this section handles the reckoning — and then explains why, uniquely for this letter, the reckoning is not the center of gravity.

The bright line first, held firm. The indictment is a set of charges, not convictions. The six officers have never been arrested, never been tried, and are in Russia, beyond any extradition; the presumption of innocence formally attaches to them as untried individuals, and this letter does not pronounce the named men personally guilty. What is established, separately and to high confidence by multiple governments and independent researchers, is the broader attribution: that these operations are the work of Russian military intelligence. The individuals are charged; the state's authorship is assessed with confidence. Those are two different claims, and the letter keeps them apart.

But here Sandworm departs from the register's usual shape, and the departure is the point. For most of this alphabet, the failure of consequence has been the tragedy — the indictment that could not reach Pyongyang, the company that walked, the arrest that was abandoned. Sandworm makes that framing feel almost quaint, because Sandworm is not a fugitive hoping to avoid a courtroom. It is a military unit of a nuclear-armed state, and the reason it faces no consequence is not that it slipped a net but that it operates under the protection of a great power's sovereignty and army. You do not arrest a foreign military unit; you deter it, or you fight it, or you fail to. The indictment named the soldiers, and that naming has real value — it establishes the record, supports sanctions, and strips deniability — but no one ever imagined it would put GRU officers in a cell. The consequence question that haunts the other letters barely applies here, because Sandworm was never going to be handled by law enforcement. It is a problem for statecraft and, ultimately, for war, and in 2022 it became exactly that.

6. The counter-narrative, steelmanned

The strongest challenge to this letter is not that Sandworm is innocent — the attribution is among the most solid in the register — but that the letter overstates its distinctiveness, and that case deserves its full weight.

The argument runs like this. Every major military power is developing offensive cyber capabilities aimed at critical infrastructure, including the power grid; the United States and its allies are widely understood to have pre-positioned in adversary networks and to hold the capability to do to others what Sandworm did to Ukraine. Singling out the Russian unit as a uniquely destructive villain, on this view, is selective: it treats as monstrous a category of state activity that all the great powers pursue, and the only real difference is that Sandworm got caught using its capability while others hold theirs in reserve. Even NotPetya, the argument continues, was a weapon that got out of control rather than an intended global attack — a botched operation against Ukraine, not a deliberate strike on Maersk and Merck, which makes it reckless rather than uniquely evil. And the grid attacks, however alarming, caused hours-long outages, not mass casualties. The letter, on this account, dresses a serious but not unique military capability in apocalyptic language.

The dossier concedes the real part and rejects the exculpation. Yes, other powers build these capabilities, and a register that pretended Sandworm's arsenal was without peer would be dishonest — the letter should be, and is, a judgment of what was actually done, not a claim that only Russia could do it. And yes, NotPetya's global spread may well have exceeded its planners' intent. But two things survive intact. First, capability held in reserve and capability actually fired at civilian infrastructure are not morally equivalent, and the distinction is the whole of the matter: many states could turn off Ukraine's lights, but Sandworm did, twice, and that crossing from possession to use is exactly what a threat register exists to record. "Others could have" is not a defense of the one who did. Second, the "it got out of control" mitigation is an indictment, not an alibi: deploying a self-spreading wiper on the global internet and losing control of it is precisely the recklessness that makes such weapons intolerable, and the ten billion dollars and the crippled hospitals are the same whether the spread was intended or merely unleashed. The counter-narrative is right that Sandworm is an instance of a category the great powers all populate. It is wrong to conclude that this makes the darkened Ukrainian winter, or the global wreckage of NotPetya, any less the specific responsibility of the unit that actually pulled the trigger.

7. Verdict — WEAPONIZED, and AT WAR

Sandworm is the letter where cyberattacks stopped being about information and started being about the physical world — where a nation's soldiers reached through the internet to turn off another nation's electricity in winter, built malware whose only purpose was to darken cities, released the most destructive and costly cyberweapon in history and watched it burn the world, poisoned its own forensic trail to frame an innocent country, and finally carried all of it openly into a full-scale war. It is the register's apex of destruction, and the only actor here whose harm is measured in darkness, in ten billion dollars of global wreckage, and in the infrastructure of a country under invasion.

The verdict's first word is what Sandworm did to the very nature of a cyberattack: WEAPONIZED. It took code out of the realm of theft and espionage and turned it into a weapon in the literal sense — something that reaches into the physical world and breaks it, that switches off the power to a quarter of a million people, that cripples the shipping and the pharmaceuticals and the hospitals of continents that were never even the target. Before Sandworm, the destructive cyberattack on physical infrastructure was a warning. Sandworm made it a fact, with dates and victim counts and a $10 billion price tag, and no one can un-make it.

The second word is where all of that has led: AT WAR. Sandworm was named, indicted, exposed — and none of it deterred the unit, because a nation's military is not deterred by a foreign indictment. Instead, when Russia invaded Ukraine in 2022, Sandworm's cyberweapons went in with the tanks: Industroyer2 against the grid, wipers against the data, the destruction it had spent years rehearsing now integrated into an open, declared war. This is the escalation the register's other letters only gesture at, made literal. The other actors evade consequence and continue their crimes. Sandworm evaded consequence and joined an army.

Twenty-one letters deep, Sandworm is the register's proof that the worst case is not theoretical. The honeypot beneath these words will never see the grid attack or the war — those are the province of the incident forensics and the sworn indictment, not of any sensor — but it swims daily in NotPetya's commodity wake: the worming, the credential theft, the leaked-exploit reuse that Sandworm industrialized into a strategic weapon. And NotPetya ties this letter to two others, because it spread on EternalBlue, the same leaked American exploit that powered North Korea's WannaCry (letter P) weeks earlier — one hoarded weapon (letter E), stolen and set loose, arming the most destructive attacks of two rival adversaries in a single summer. The vectors do not lie: the lights went out, the wiper escaped, the officers were named, the unit went to war. Judge the soldiers who turned off the electricity and called it an operation. Then remember the Ukrainians in the dark, and the hospitals a continent away that went down for a war they had no part in — and understand that the weapon that did it is now, openly, a tool of an army in the field.

The Alphabet of Actors continues. Verdict: WEAPONIZED, and AT WAR. Confidence: HIGH on the attribution of the Ukraine grid attacks, NotPetya, Olympic Destroyer, and the 2022 wartime operations to Russian military intelligence (GRU Unit 74455) — a multi-government assessment anchored by the 2020 US DOJ indictment as a primary sworn source; the charges against the six named officers are charges, not convictions, and the presumption of innocence formally applies to the untried individuals. Ukrainian civilians left without power and NotPetya's global collateral victims, including hospitals, are centered as the harm. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the military that weaponized the grid, the weapon that could not be contained, and the difference between a capability held in reserve and one actually fired at the lights.