Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers

Andy Greenberg's account of the GRU hacking unit designated Sandworm is the most important piece of long-form investigative reporting on Russian offensive cyber operations to have been published. Beginning with the NotPetya cyberattack of 2017 — the most destructive cyberattack in history, which caused an estimated $10 billion in global damage — Greenberg traces the unit's activities across a decade: the attacks on Ukrainian power grids in 2015 and 2016, the Olympic Destroyer operation, and the infiltration of US political infrastructure. The narrative is gripping, but the analytical substance is serious.

Sandworm matters for practitioners in the information environment because it documents, in operational detail, how cyber operations and information operations are integrated in Russian doctrine. NotPetya was not just an attack on infrastructure; it was a statement about Russia's willingness and capability to conduct hybrid operations at scale. The book demonstrates that the boundary between cyber warfare and information warfare is not technical — it is conceptual. Understanding how they are combined in practice, as Greenberg shows, is essential for any organisation assessing its exposure to state-sponsored threats.