For years, the hacking unit inside Russia’s GRU army intelligence company often known as Sandworm has carried out a few of the worst cyberattacks in historical past—blackouts, faux ransomware, data-destroying worms—from behind a fastidiously maintained veil of anonymity. However after half a decade of the spy company’s botched operations, blown cowl tales, and worldwide indictments, maybe it is no shock that pulling the masks off the person main that extremely damaging hacking group immediately reveals a well-known face.
The passport Evgenii Serebriakov used to enter the Netherlands in 2018.
{Photograph}: Division of Justice
The commander of Sandworm, the infamous division of the company’s hacking forces chargeable for most of the GRU’s most aggressive campaigns of cyberwar and sabotage, is now an official named Evgenii Serebriakov, in line with sources from a Western intelligence service who spoke to WIRED on the situation of anonymity. If that identify rings a bell, it might be as a result of Serebriakov was indicted, together with six different GRU brokers, after being caught within the midst of a close-range cyberespionage operation within the Netherlands in 2018 that focused the Group for the Prohibition of Chemical Weapons within the Hague.
In that foiled operation, Dutch legislation enforcement did not simply determine and arrest Serebriakov and his group, who had been a part of a distinct GRU unit generally called Fancy Bear or APT28. In addition they seized Serebriakov’s backpack stuffed with technical tools, in addition to his laptop computer and different hacking gadgets in his group’s rental automobile. In consequence, Dutch and US investigators had been in a position to piece collectively Serebriakov’s travels and previous operations stretching again years and, given his newer function, now know in uncommon element the profession historical past of a rising GRU official.
In keeping with the intelligence service sources, Serebriakov was positioned accountable for Sandworm within the spring of 2022 after serving as deputy commander of APT28, and now holds the rank of colonel. Christo Grozev, the lead Russia-focused investigator for open supply intelligence outlet Bellingcat, has additionally famous Serebriakov’s rise: Round 2020, Grozev says, Serebriakov started receiving cellphone calls from GRU generals who, within the company’s strict hierarchy, solely converse to higher-level officers. Grozev, who says he purchased the cellphone knowledge from a Russian black market supply, says he additionally noticed the GRU agent’s quantity seem within the cellphone information of one other highly effective army unit targeted on counterintelligence. “I noticed he have to be in a command place,” says Grozev. “He cannot simply be a daily hacker anymore.”
The truth that Serebriakov seems to have attained that place regardless of having been beforehand recognized and indicted within the failed Netherlands operation means that he will need to have important worth to the GRU—that he is “apparently too good to dump,” Grozev provides.
Serebriakov’s new place main Sandworm—formally GRU Unit 74455 but in addition identified by the nicknames Voodoo Bear and Iridium—places him accountable for a gaggle of hackers who’re maybe the world’s most prolific practitioners of cyberwar. (They’ve additionally dabbled in espionage and disinformation campaigns.) Since 2015, Sandworm has led the Russian authorities’s unprecedented marketing campaign of cyberattacks on Ukraine: It penetrated electrical utilities in western Ukraine and Kyiv to trigger the first- and second-ever blackouts triggered by hackers and focused Ukrainian authorities companies, banks, and media with numerous data-destructive malware operations. In 2017, Sandworm launched NotPetya, a chunk of self-replicating code that unfold to networks worldwide and inflicted a document $10 billion in injury. Sandworm then went on to sabotage the 2018 Winter Olympics in Korea and assault TV broadcasters within the nation of Georgia in 2019, a stunning document of reckless hacking.