{
	"id": "d90d6d20-ef67-43fe-bee0-97defa15685c",
	"created_at": "2026-04-06T00:16:56.861417Z",
	"updated_at": "2026-04-10T03:30:30.853586Z",
	"deleted_at": null,
	"sha1_hash": "55e4a450513b0bec2cf3d7bf6a09dab2b81adf12",
	"title": "Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1116642,
	"plain_text": "Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and\r\nRelentless\r\nBy Andy Greenberg\r\nPublished: 2022-11-10 · Archived: 2026-04-05 18:49:45 UTC\r\nSecurity researchers see updated tactics and tools—and a tempo change—in the cyberattacks Russia’s GRU\r\nmilitary intelligence agency is inflicting on Ukraine.\r\nIllustration: Jacqui VanLiew; Getty Images\r\nAll products featured on WIRED are independently selected by our editors. However, we may receive\r\ncompensation from retailers and/or from purchases of products through these links. Learn more.\r\nSince Russia launched its catastrophic full-scale invasion of Ukraine in February, the cyberwar that it has long\r\nwaged against its neighbor has entered a new era too—one in which Russia has at times seemed to be trying to\r\ndetermine the role of its hacking operations in the midst of a brutal, physical ground war. Now, according to the\r\nfindings of a team of cybersecurity analysts and first responders, at least one Russian intelligence agency seems to\r\nhave settled into a new set of cyberwarfare tactics: ones that allow for quicker intrusions, often breaching the same\r\ntarget multiple times within just months, and sometimes even maintaining stealthy access to Ukrainian networks\r\nwhile destroying as many as possible of the computers within them.\r\nYou’ve read your last free article.\r\nhttps://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/\r\nPage 1 of 3\n\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters—cancel anytime.\r\nSTART FREE TRIAL\r\nAlready a subscriber? Sign In\r\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters START FREE TRIAL\r\nhttps://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/\r\nPage 2 of 3\n\nAndy Greenberg is a senior writer for WIRED covering hacking, cybersecurity, and surveillance. He’s the author\r\nof the books Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency and Sandworm: A New\r\nEra of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. His books ... Read More\r\nDon't Just Keep Up. Get Ahead\r\nSign up for the Daily newsletter to get our biggest stories, handpicked for you each day.\r\nSource: https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/\r\nhttps://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/"
	],
	"report_names": [
		"russia-ukraine-cyberattacks-mandiant"
	],
	"threat_actors": [
		{
			"id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df",
			"created_at": "2023-01-06T13:46:38.402513Z",
			"updated_at": "2026-04-10T02:00:02.959797Z",
			"deleted_at": null,
			"main_name": "Sandworm",
			"aliases": [
				"IRIDIUM",
				"Blue Echidna",
				"VOODOO BEAR",
				"FROZENBARENTS",
				"UAC-0113",
				"Seashell Blizzard",
				"UAC-0082",
				"APT44",
				"Quedagh",
				"TEMP.Noble",
				"IRON VIKING",
				"G0034",
				"ELECTRUM",
				"TeleBots"
			],
			"source_name": "MISPGALAXY:Sandworm",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "7bd810cb-d674-4763-86eb-2cc182d24ea0",
			"created_at": "2022-10-25T16:07:24.1537Z",
			"updated_at": "2026-04-10T02:00:04.883793Z",
			"deleted_at": null,
			"main_name": "Sandworm Team",
			"aliases": [
				"APT 44",
				"ATK 14",
				"BE2",
				"Blue Echidna",
				"CTG-7263",
				"FROZENBARENTS",
				"G0034",
				"Grey Tornado",
				"IRIDIUM",
				"Iron Viking",
				"Quedagh",
				"Razing Ursa",
				"Sandworm",
				"Sandworm Team",
				"Seashell Blizzard",
				"TEMP.Noble",
				"UAC-0082",
				"UAC-0113",
				"UAC-0125",
				"UAC-0133",
				"Voodoo Bear"
			],
			"source_name": "ETDA:Sandworm Team",
			"tools": [
				"AWFULSHRED",
				"ArguePatch",
				"BIASBOAT",
				"Black Energy",
				"BlackEnergy",
				"CaddyWiper",
				"Colibri Loader",
				"Cyclops Blink",
				"CyclopsBlink",
				"DCRat",
				"DarkCrystal RAT",
				"Fobushell",
				"GOSSIPFLOW",
				"Gcat",
				"IcyWell",
				"Industroyer2",
				"JaguarBlade",
				"JuicyPotato",
				"Kapeka",
				"KillDisk.NCX",
				"LOADGRIP",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"ORCSHRED",
				"P.A.S.",
				"PassKillDisk",
				"Pitvotnacci",
				"PsList",
				"QUEUESEED",
				"RansomBoggs",
				"RottenPotato",
				"SOLOSHRED",
				"SwiftSlicer",
				"VPNFilter",
				"Warzone",
				"Warzone RAT",
				"Weevly"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434616,
	"ts_updated_at": 1775791830,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/55e4a450513b0bec2cf3d7bf6a09dab2b81adf12.pdf",
		"text": "https://archive.orkl.eu/55e4a450513b0bec2cf3d7bf6a09dab2b81adf12.txt",
		"img": "https://archive.orkl.eu/55e4a450513b0bec2cf3d7bf6a09dab2b81adf12.jpg"
	}
}