Security

The Story of Sandworm, the Kremlin's Most Dangerous Hackers

For three years, WIRED has tracked the elite and shadowy Russian vanguard of cyberwar.
Illustration: Curt Merlo

If you buy something using links in our stories, we may earn a commission. Learn more.

Over the last half decade, the world has witnessed a disturbing escalation in disruptive cyberattacks. In 2015 and 2016, hackers snuffed out the lights for hundreds of thousands of civilians in the first power outages ever triggered by digital sabotage. Then came the most expensive cyberattack in history, NotPetya, which inflicted more than $10 billion in global damage in 2017. Finally, the 2018 Olympics became the target of the most deceptive cyberattack ever seen, masked in layers of false flags.

In fact, those unprecedented events aren't merely the recent history of cyberwarfare’s arms race. They're all linked back to a single, highly dangerous group of hackers: Sandworm.

Since late 2016, I've been tracing the fingerprints of these Russian operatives from the US to Ukraine to Copenhagen to Korea to Moscow. The result is the book Sandworm, available Tuesday from Doubleday. But parts of that reporting have also been captured in a series of WIRED magazine features, which have charted the arc of Sandworm's rise and catalogued some of its most brazen attacks. Here, together, are those three stories, from the first shots fired in Sandworm's cyberwar against Ukraine, to the ballooning international toll of NotPetya, to the mysterious attack on the Pyeongchang Olympics, whose fingerprints ultimately led back to a tower looming over the Moscow canal.

Image may contain: Pattern
How an Entire Nation Became Russia's Test Lab for Cyberwar
Blackouts in Ukraine were just a trial run. Russian hackers are learning to sabotage infrastructure—and the US could be next.
Image may contain: Window
The Untold Story of NotPetya, the Code that Crashed the World
Crippled ports. Paralyzed corporations. Frozen government agencies. Inside the most devastating cyberattack in history.
a photo-illustration of the olympic ceremony
Inside Olympic Destroyer, the Most Deceptive Hack in History
The untold story of how digital detectives unraveled the mystery of Olympic Destroyer—and why the next big cyberattack will be even harder to crack.

When you buy something using the retail links in our stories, we may earn a small affiliate commission. Read more about how this works.

More Great WIRED Stories