GRU Unit 74455 (Sandworm/APT44)

Force in Play

As of May 2026: Active, conducting ongoing operations against Western infrastructure

From 2021 to 2025, Amazon exposed that Sandworm (GRU Unit 74455)—the team behind NotPetya and Ukraine's grid attacks—had shifted to infiltrating misconfigured devices at Western utilities, energy companies, and security providers. They compromised edge devices, harvested credentials, and penetrated networks across North America and Europe.

Updated May 16