Sandworm

The name of a group conducting cyber attacks in whose activities, according to the Council of the EU, the GTsST of Russian military intelligence plays an active role.

Based on Council Decision (CFSP) 2020/1127.¹

In a statement of 19 October 2020 the UK government said that the GRU’s GTsST (military unit 74455) is known in open sources as, among other names, Sandworm, VoodooBear and BlackEnergy Group. The UK’s NCSC assessed with high confidence (95%+) that it was this unit that attacked the 2018 Winter Games in Pyeongchang with the Olympic Destroyer malware, posing as North Korean and Chinese hackers (see false flag), and that it conducted reconnaissance against the organisers of the Tokyo Games before they were postponed.²

“Sandworm” is a name given by researchers, not the unit’s official name. SpyOps.pl uses the names of APT groups only in the form found in government and EU documents, and names perpetrators solely on the basis of their official attributions (see attribution).^1,2

More in the operation card: NotPetya.