Sandworm (GRU Unit 74455)
An attacker group tied to Russian military intelligence, the presumed author of the Ukrainian grid attacks and NotPetya, named in US indictments and EU sanctions.
Sandworm is the name security researchers give to Unit 74455 of Russian military intelligence, also called the Main Center for Special Technologies. It is the group most associated with destructive cyber operations against civilian infrastructure. It is credited with the Ukrainian power outages of 2015 and 2016, the 2017 NotPetya attack, which caused several billion dollars of losses to companies worldwide, the cyber sabotage of the opening ceremony of the 2018 Pyeongchang Winter Olympics and hack-and-leak operations during elections. In October 2020, the US Justice Department indicted six officers of the unit; the same year, the European Union listed it under its cyber sanctions regime for NotPetya. For insurance, Sandworm matters in a particular way: it is the very example of a state attacker whose operations spill beyond their target. NotPetya aimed at Ukraine and hit multinationals everywhere; the litigation that followed, over applying a war exclusion drafted for classic armed conflicts, led the market to rewrite its cyber war clauses. The case also shows why attribution matters: the exclusion depends on the state characterization.
Textbook case: an insurer receives a claim from a manufacturer whose network was encrypted by malware posing as ransomware, with no real decryption mechanism. The technical indicators match tools attributed to Sandworm: the insurer must then examine whether the conditions of its cyber war clause are met, attribution included.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.