For many years, the The hacking unit in Russia’s GRU military intelligence agency known as Sandworm has carried out some of the worst cyberattacks in history—power outages, rogue ransomware, data destruction worms—from behind a carefully maintained veil of anonymity. But after half a decade of spy agency failures, hyped cover stories and international indictments, it’s perhaps no surprise that pulling the mask off the man in charge. Today’s highly destructive hacker group reveals a familiar face.
The commander of Sandworm, the notorious division of the agency’s hacking force responsible for many of the GRU’s most powerful cyberattacks and sabotage campaigns, is now an official named Evgenii Serebriakov, according to a source from a source close to the matter. Western intelligence agencies spoke to WIRED about the situation. incognito. If that name rings a bell, it’s probably because Serebriakov was prosecutealong with six other GRU agents, after being caught between a close-in cyber espionage in the Netherlands in 2018 targeted the Organization for the Prohibition of Chemical Weapons in The Hague.
During that failed operation, Dutch law enforcement not only identified and arrested Serebriakov and his team, who were part of another GRU unit commonly known as Fancy Bear or APT28. They also seized a backpack filled with Serebriakov’s technical equipment, as well as laptops and other hacking devices in his team’s rented car. As a result, Dutch and US investigators were able to piece together Serebriakov’s past trips and activities that spanned many years and, given his newer role, now know the details of his history. career history of a rising GRU official.
According to intelligence sources, Serebriakov was put in charge of Sandworm in the spring of 2022 after serving as deputy commander of APT28, and currently holds the rank of colonel. Christo Grozev, the principal Russia-focused investigator for the open-source intelligence agency Bellingcat, also noted Serebriakov’s rise: Around 2020, says Grozev, Serebriakov started receiving calls from GRU generals, those in the strict hierarchy of the agency, talking only to the higher ups. officials. Grozev, who said he purchased phone data from a Russian black market source, said that he also saw the GRU agent’s number appear in the phone records of another powerful military unit focused on operations. counterintelligence. “I realized that he had to be in command,” said Grozev. “He can’t just be a regular hacker anymore.”
The fact that Serebriakov appears to have reached that position despite being previously identified and prosecuted during the failed Dutch campaign suggests that he must have been of considerable value to the GRU – that he “seems too good to be dumping,” Grozev added.
Serebriakov’s new position as leader of the Sandworm—formally GRU’s Unit 74455 but also known by the nicknames Voodoo Bear and Iridium—puts him in charge of a group of hackers who are probably practitioners of cyber warfare a lot. best of the world. (They have also been involved in espionage and disinformation campaigns.) Since 2015, Sandworm has led the Russian government’s unprecedented campaign of cyberattacks into Ukraine: It infiltrated companies. electricity in western Ukraine and Kyiv to causing first and second power outages triggered by hackers and targeted Ukrainian government agencies, banks and media with a multitude of data-destroying malware activities. In 2017, Sandworm released NotPetya, A self-replicating piece of code spreads to networks around the world and causes a record $10 billion in damage. Sandworms then continue sabotage the 2018 Winter Olympics in Korea and hacked television stations in the nation of Georgia in 2019, a shocking record of reckless hacking.
