OrganisationRU

Sandworm

Hacking group linked to Russia's GRU military intelligence, blamed for the 2017 NotPetya wiper.

Sandworm is a Russia-aligned hacking group commonly attributed to the GRU's Unit 74455 and blamed for the destructive 2017 NotPetya outbreak.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Was the grain-company wipe an isolated hand-off or Sandworm's standard operating model?

Timeline for Sandworm

#15 21 Oct

Ran a wiper attack on a Ukrainian grain firm

Cybersecurity: Threats and Defences: ESET ties Sandworm to Ukraine grain wipe

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Sandworm is a Russia-aligned hacking group known for destructive cyber operations. Western governments and security researchers commonly attribute it to Unit 74455 of Russia's GRU military intelligence service. The group has been blamed for attacks on Ukrainian Energy infrastructure and the 2017 NotPetya outbreak.

Sandworm's operations have included data-wiping malware, which erases files or makes systems unusable. A wiper differs from ransomware because its purpose is destruction rather than recoverable encryption used to demand payment. Public claims about Sandworm therefore depend on the attribution and confidence stated by the government agency or security researcher making them. Researchers also track the group as a state-aligned actor.

Common Questions

Who is Sandworm?

Sandworm is a Russia-aligned destructive threat group commonly attributed to the GRU's Unit 74455 by Western governments and security researchers.Source: US Department of Justice

What did Sandworm do to the Ukrainian grain company?

ESET attributes with high confidence a September 2025 data-wiping attack to Sandworm. A wiper erases data or leaves systems unusable rather than holding recoverable files for ransom.Source: ESET Research

How certain is ESET that Sandworm ran the grain-company wipe?

ESET says high confidence, based on the tactics, techniques and procedures used in the destructive stage.Source: ESET Research

Why is Sandworm linked to UAC-0099?

ESET assesses with high confidence that UAC-0099 handed its initial access to Sandworm. It could not determine which group mainly operated the MythicRatatoskr backdoor during the intrusion.Source: ESET Research

Source Material

Infamous Chisel Malware Analysis Report Six Russian GRU officers charged over destructive malware deployments MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.