How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).

Ukraine Grid IHigh Confidence

Attributed by US Government, Academic/Private Sector, Allied Coalition · Consequences: Public Naming Only

Ukraine Grid IIHigh Confidence

Attributed by Academic/Private Sector, US Government, Allied Coalition · Consequences: Indictment, Public Naming Only

NotPetyaConfirmed

Attributed by UK Government, US Government, Allied Coalition, EU, Academic/Private Sector · Consequences: Sanctions, Indictment, Public Naming Only

Viasat KA-SATConfirmed

Attributed by EU, UK Government, US Government, Academic/Private Sector · Consequences: Sanctions, Public Naming Only

Industroyer2Confirmed

Attributed by Academic/Private Sector, Allied Coalition · Consequences: Public Naming Only

KyivstarConfirmed

Attributed by Academic/Private Sector, Allied Coalition · Consequences: Public Naming Only

TTP Pattern Summary

Sandworm consistently demonstrates ICS/SCADA-targeting capability, deploying purpose-built malware to interact directly with industrial protocols (IEC 104, IEC 61850). The group chains supply-chain compromise or credential-based access with disk-wiping components to delay forensic analysis. In wartime operations, Sandworm coordinates cyber attacks with kinetic military operations, as seen in the Viasat and Industroyer campaigns.

Impact (8)Impact (ICS) (4)Initial Access (3)Persistence (2)Execution (2)Lateral Movement (1)

Behavioural Signature

Sandworm pursues strategic-level disruption with a willingness to accept collateral damage. Its operations exhibit progressive sophistication across multi-year attack cycles (2015 manual grid attack → 2016 automated Industroyer → 2022 Industroyer2). The group tolerates high visibility and attribution risk, suggesting its operations serve primarily as demonstrations of capability and coercive signalling rather than covert intelligence collection.

Governance Footprint

Subject to the broadest multilateral attribution campaign of any cyber actor. Named in US DOJ indictments (2020), Five Eyes joint attribution (2018), EU sanctions. Sandworm operations have been central to international debates on IHL applicability to cyber operations in armed conflict.