Winter is Coming — Along with Russia’s Elite Hackers

The Sandworm group, one of the most infamous Kremlin-backed cyber threat actors, has long operated in the shadows, carrying out some of the most high-profile cyberattacks. Western intelligence agencies have attributed the group to major incidents, including a 2015 cyberattack that caused a shutdown of Ukraine’s power grid and another attack that targeted Ukraine’s energy infrastructure in 2023. Sandworm is believed to operate under Russia’s military intelligence agency, the GRU, as confirmed by the U.K. government in official reports.

The latest warnings come amidst heightened tensions in Europe, where governments are currently investigating the rupture of two critical undersea telecom cables connecting EU countries. This incident is part of a growing trend of “hybrid” warfare tactics, including sabotage, physical disruptions, and digital attacks, which have escalated significantly along Europe’s eastern border with Russia since Moscow’s 2022 invasion of Ukraine.

These developments compound the energy sector’s challenges following a sharp rise in gas prices earlier in the week. The price hike followed Russian energy giant Gazprom’s announcement that it would cut off supplies to OMV, Austria’s largest natural gas importer, due to a contractual dispute.

European governments are probing the rupture of undersea telecom cables linking EU nations. | Ander Gillenea/AFP via Getty Images.

Sandra Joyce, head of threat intelligence at Google’s Mandiant cyber division, highlighted the ongoing risks posed by Sandworm during her remarks at the Tallinn Digital Summit in Estonia on Tuesday.

“They’re actively targeting Europe’s energy grid as we speak,” Joyce warned, underscoring the group’s persistent focus on critical infrastructure.

In its April report, Google reiterated Sandworm’s growing threat, referring to the group as APT44 or Seashell Blizzard. Google described Sandworm as a key player in Russia’s cyber warfare efforts, emphasizing that “no other Russian government-backed cyber group has had a more central role in supporting and shaping Russia’s military campaign in Ukraine.”

The situation underscores the mounting challenges European nations face, both on the physical and digital fronts, as geopolitical tensions with Russia remain high.