Sandworm Team (GRU Unit 74455)
Russia, GRU (Main Intelligence Directorate), assessed to be Unit 74455
- State organ
- GRU Unit 74455
- MITRE ATT&CK groups
- G0034
- Attribution basis
- On-record government attribution (Five Eyes 2018, EU 2020) and the 2020 US indictment.
Mission Type
Disruption and destruction of critical infrastructure, strategic sabotage in support of Russian military and geopolitical objectives
Primary Sectors
Operational Period
2014 – present
Attributed Cases
6
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by US Government (technical, no attribution), Academic/Private Sector, US Government · Consequences: Indictment, Public Naming
Attributed by Academic/Private Sector, US Government, Allied Coalition · Consequences: Indictment, Public Naming
Attributed by UK Government, US Government, Allied Coalition, EU, Academic/Private Sector · Consequences: Sanctions, Indictment, Public Naming
Attributed by EU, UK Government, US Government, Academic/Private Sector · Consequences: Public Naming
Attributed by Ukraine Government (CERT-UA), Academic/Private Sector · Consequences: Public Naming
Attributed by Ukraine Government (SBU) · Consequences: Public Naming
TTP Pattern Summary
Sandworm consistently demonstrates ICS/SCADA-targeting capability, deploying purpose-built malware to interact directly with industrial protocols (IEC 104, IEC 61850). The group chains supply-chain compromise or credential-based access with disk-wiping components to delay forensic analysis. In wartime operations, Sandworm coordinates cyber attacks with kinetic military operations, as seen in the Viasat and Industroyer campaigns.
Behavioural Signature
Sandworm pursues strategic-level disruption with a willingness to accept collateral damage. Its operations exhibit progressive sophistication across multi-year attack cycles (2015 manual grid attack → 2016 automated Industroyer → 2022 Industroyer2). The group tolerates high visibility and attribution risk, suggesting its operations serve primarily as demonstrations of capability and coercive signalling rather than covert intelligence collection.
Governance Footprint
Subject to the broadest multilateral attribution campaign of any cyber actor. Named in US DOJ indictments (2020), Five Eyes joint attribution (2018), EU sanctions. Sandworm operations have been central to international debates on IHL applicability to cyber operations in armed conflict.