Overview
Amazon exposed what Russia's most notorious cyber unit was doing while the world wasn't watching. From 2021 through 2025, GRU Unit 74455—the Sandworm team behind NotPetya and Ukraine's grid attacks—quietly evolved its playbook, abandoning flashy zero-day exploits for something harder to defend against: hunting misconfigured network devices protecting Western electric utilities, energy companies, and their security providers. They compromised edge devices, harvested credentials, and penetrated organizational networks across North America and Europe.
This wasn't a smash-and-grab raid. It was reconnaissance at scale. Amazon Threat Intelligence tracked the campaign for years, watching as Sandworm pivoted from explosive attacks that made headlines to patient infiltration designed to map critical systems. The same unit that left 230,000 Ukrainians without power in 2015 and unleashed $10 billion in NotPetya damages is now inside Western energy infrastructure—and the full scope of what they've accessed remains unknown.
Key Indicators
People Involved
Organizations Involved
Russia's premier cyber sabotage unit, responsible for the most destructive attacks in cyber history.
Amazon's security intelligence arm tracking threats to cloud infrastructure and customer environments.
America's cyber defense agency coordinating protection of critical infrastructure.
Timeline
-
Amazon Exposes Five-Year Campaign
Intelligence DisclosureAmazon Threat Intelligence publicly disclosed Sandworm's sustained 2021-2025 campaign targeting Western energy infrastructure. Amazon identified 10+ victim organizations, notified customers, remediated compromised systems, and shared intelligence with partners.
-
CISA Advisory on Pro-Russia Hacktivists
Government AdvisoryCISA, FBI, NSA, DOE, and EPA issued joint advisory detailing pro-Russia hacktivist groups exploiting VNC connections to attack water, agriculture, and energy sectors—lower sophistication than APT44 but demonstrating sustained focus.
-
FBI Warns of FSB Targeting Network Devices
Government AdvisoryFBI issued warning that Russian FSB cyber actors were exploiting SNMP protocols and end-of-life networking devices to broadly target U.S. and global entities, complementing GRU's infrastructure campaign.
-
Mandiant Upgrades to APT44 Designation
Intelligence AssessmentGoogle's Mandiant threat intelligence graduated Sandworm to APT44, recognizing the unit's full-spectrum capabilities across espionage, attack, and influence operations and its threat to governments and critical infrastructure globally.
-
Tactical Shift to Misconfiguration Targeting
Operational EvolutionSandworm reduced investment in zero-day exploitation, pivoting to sustained targeting of misconfigured network edge devices—VPNs, routers, firewalls—with exposed management interfaces. Campaign targeted energy utilities and MSSPs.
-
Industroyer2 Attack Thwarted in Ukraine
Attempted CyberattackSandworm deployed Industroyer2 targeting a Ukrainian energy supplier, scheduled to cut power for a region affecting 2 million people. CERT-UA and ESET researchers identified and stopped the attack before execution.
-
Western Infrastructure Campaign Begins
Cyber EspionageSandworm launched sustained targeting of Western critical infrastructure, initially exploiting zero-day and N-day vulnerabilities in WatchGuard, Confluence, and other network edge devices across North America and Europe.
-
DOJ Indicts Six Unit 74455 Officers
Legal ActionFederal grand jury in Pittsburgh charged Yuriy Andrienko, Sergey Detistov, Pavel Frolov, Anatoliy Kovalev, Artem Ochichenko, and Petr Pliskin with conducting the most destructive cyber-attacks in history. $10 million reward offered.
-
Olympic Destroyer Disrupts Winter Games
Destructive CyberattackSandworm deployed Olympic Destroyer malware during the 2018 Winter Olympics opening ceremony in Pyeongchang, compromising thousands of computers in retaliation for Russia's doping ban from the games.
-
NotPetya Unleashed Globally
Destructive CyberattackUnit 74455 deployed NotPetya via compromised Ukrainian accounting software M.E.Doc. Disguised as ransomware, it was actually a wiper causing over $10 billion in global damages across thousands of organizations.
-
Ukraine Grid Hit with Industroyer
Destructive CyberattackSandworm deployed Industroyer, the first malware specifically designed to attack electrical grids, targeting Kyiv's 330 kilowatt electrical substation and cutting one-fifth of the city's nighttime power consumption.
-
Sandworm's First Power Grid Attack
Destructive CyberattackGRU Unit 74455 executed the first successful cyberattack on a power grid, targeting three Ukrainian energy companies with BlackEnergy malware. Attackers opened breakers at 30 substations, leaving 230,000 residents without power for up to six hours.
Scenarios
Coordinated Grid Attack During Geopolitical Crisis
Discussed by: Cybersecurity analysts and critical infrastructure experts at CISA, academic researchers studying Ukraine grid precedents
Sandworm leverages five years of reconnaissance to execute coordinated attacks on Western energy grids during a NATO-Russia crisis, replicating Ukraine tactics at scale. Having already compromised edge devices and harvested credentials, the unit could simultaneously target multiple utilities, causing cascading blackouts. This scenario mirrors the 2015 and 2016 Ukraine attacks but scaled to North American and European infrastructure with far greater economic impact. The timeline from intrusion to attack could be measured in hours, not months, given pre-positioned access.
Persistent Espionage Without Kinetic Action
Discussed by: Amazon Threat Intelligence, Mandiant researchers, defensive security strategists
Russia maintains access for intelligence collection without triggering destructive payloads, mapping critical systems and maintaining options for future leverage. This approach maximizes strategic value while minimizing diplomatic blowback—Unit 74455 knows where the kill switches are but doesn't flip them. The campaign continues as long-term reconnaissance, allowing Russia to understand grid vulnerabilities, energy dependencies, and emergency response procedures. Detection remains difficult because nothing breaks, and organizations may not discover they've been compromised for years.
Supply Chain Compromise via MSSP Targeting
Discussed by: Cloud security researchers, IBM and Verizon breach report analysts, industrial cyber defenders
Sandworm's targeting of managed security service providers becomes a force multiplier, turning defenders into attack vectors. By compromising MSSPs with privileged access across energy sector clients, Unit 74455 could achieve what the 2020 SolarWinds and 2021 Kaseya attacks demonstrated: one breach exposing hundreds of organizations. Amazon's identification of MSSP victims suggests this pathway is already being explored. A successful MSSP compromise could provide simultaneous access to dozens of electric utilities without requiring individual intrusions.
Discovery and Remediation, Campaign Ends
Discussed by: Optimistic cybersecurity professionals, Amazon customer security teams
Amazon's disclosure triggers comprehensive security reviews across energy sector organizations, leading to widespread discovery and remediation of compromised systems. Utilities implement edge device hardening, disable exposed management interfaces, rotate credentials, and deploy enhanced monitoring for credential replay attacks. Within 6-12 months, Sandworm's five-year investment is neutralized through coordinated defensive action. This scenario requires unprecedented coordination and resource commitment from organizations that have historically underfunded cybersecurity.
Historical Context
2015 Ukraine Power Grid Attack (BlackEnergy)
December 23, 2015What Happened
GRU Unit 74455 executed the first successful cyberattack on a power grid, targeting three Ukrainian energy distribution companies. Attackers delivered BlackEnergy malware via spearphishing eight months before the attack, conducted extensive reconnaissance of OT networks, then remotely opened breakers at 30 substations. The attack lasted minutes but left 230,000 residents without power for up to six hours. KillDisk malware wiped systems and corrupted master boot records, rendering them inoperable.
Outcome
Short term: Six-hour blackout affecting 230,000 people; attackers demonstrated ability to translate cyber operations into kinetic effects on critical infrastructure.
Long term: Established blueprint for industrial control system attacks; prompted global critical infrastructure cybersecurity investments; led to Ukraine developing world-class defensive capabilities through necessity.
Why It's Relevant
The 2021-2025 Western campaign follows the same unit's playbook: patient reconnaissance, credential harvesting, and pre-positioning for potential destructive attacks. The difference is scale—Western grids serve millions, not thousands.
2017 NotPetya Attack ($10B Damages)
June 27, 2017What Happened
Sandworm compromised the update mechanism of M.E.Doc, Ukrainian accounting software used by thousands of organizations. On June 27, they pushed NotPetya—malware disguised as ransomware but actually a wiper designed to destroy data. The attack spread globally within hours, crippling Maersk shipping, pharmaceutical giant Merck, FedEx subsidiary TNT, and thousands of other organizations. Total damages exceeded $10 billion, making it the most costly cyberattack in history.
Outcome
Short term: Global business disruption; Maersk reinstalled 4,000 servers and 45,000 PCs; Merck's vaccine production halted; hundreds of organizations suffered permanent data loss.
Long term: Demonstrated that cyber operations could achieve strategic economic impact comparable to conventional military action; prompted insurance industry to reconsider cyber coverage; established precedent for nation-state malware causing collateral damage far beyond intended targets.
Why It's Relevant
NotPetya proved Unit 74455 is willing to cause massive economic damage even when collateral impact extends globally. The current campaign's targeting of Western energy infrastructure carries similar—or greater—destructive potential.
2020 SolarWinds Supply Chain Compromise
March 2020 - December 2020What Happened
Russian SVR intelligence (not GRU, but demonstrating Russian doctrine) compromised SolarWinds Orion software, used by 18,000 organizations including U.S. government agencies and Fortune 500 companies. Attackers inserted malicious code into legitimate software updates, turning SolarWinds into an unwitting distribution mechanism for espionage malware. The campaign remained undetected for nine months until FireEye discovered they'd been breached.
Outcome
Short term: Massive incident response effort across U.S. government and private sector; multiple agencies confirmed compromised; extensive forensic investigation required.
Long term: Fundamentally shifted understanding of supply chain risk; prompted Executive Order 14028 on cybersecurity; established that software supply chain is a viable strategic attack vector for espionage at scale.
Why It's Relevant
Sandworm's targeting of managed security service providers in the current campaign follows similar logic—compromise one provider to access many clients. The combination of Russia's SolarWinds-proven supply chain methodology with Unit 74455's destructive track record is especially concerning.