Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers

by Andy Greenberg

simple. Yushchenko turned out to be an inspiring but disorganized leader, warring with his prime minister, Yulia Tymoshenko. The government deadlocked and the economy foundered. Amazingly, Yanukovich managed to wheedle his way back into the spotlight, thanks in part to his Russian backing and a makeover overseen by the U.S. lobbyist Paul Manafort, the future campaign manager of Donald Trump.

If Trump sensed the news could be used against him politically, he was right. In late June 2017, eighteen Democratic senators and Independent Bernie Sanders signed a letter to the president, citing Dragos’s work and demanding Trump direct the Department of Energy to conduct a new analysis of the Russian government’s capabilities to disrupt America’s power grid. They also asked for an exploration of any attempts the Kremlin had already made to compromise America’s electric utilities, pipelines, or other energy infrastructure. “We are deeply concerned that your administration has not backed up a verbal commitment prioritizing cybersecurity of energy networks and fighting cyber aggression with any meaningful action,” the legislators wrote. The White House never responded.

Along with that release, the Shadow Brokers this time posted a fifteen-hundred-word rambling open letter pleading with Trump to stay in touch with his far-right nationalist base, and not to give in to the “deep state” and “globalists.” The hackers criticized Trump’s decision to launch air strikes in Syria in retaliation for chemical weapons used by the country’s Russia-backed dictator, Bashar al-Assad. They now claimed that despite theories of their Russian origin they were actually former U.S. intelligence officers who had become conscientious objectors. They railed against Goldman Sachs, Zionists, socialists, and Russia critics: We recognize Americans’ having more in common with Russians than Chinese or Globalist or Socialist. Russia and Putin are nationalist and enemies of the Globalist, examples: NATO encroachment and Ukraine conflict. Therefore Russia and Putin are being best allies until the common enemies are defeated and America is great again.

The Trump administration, of course, had made those concessions to Putin far more explicit. Trump’s nihilistic denials had made Russia’s hacking of American election targets a subject for debate—in the face of mounting, incontrovertible evidence—leaving no space for even a discussion of the vastly more aggressive hacking of critical institutions in Ukraine. At the same time, Trump had overtly praised Putin, repeatedly calling him a “strong leader” in public comments and even complimenting his response to the Obama administration’s sanctions. Meanwhile, his administration’s broader isolationism telegraphed to the world that Ukraine would be entirely on its own in the face of Russian attacks—physical or digital. “Why should U.S. taxpayers be interested in Ukraine?” Trump’s secretary of state, Rex Tillerson, callously asked a group of diplomats at a gathering in Italy, three months before NotPetya’s release.

As soon as Matonis saw the account-loginserv.com domain, he instantly knew that he had seen it nearly a year earlier in an FBI “flash,” a short alert sent out to U.S. cybersecurity practitioners and potential victims. This one had offered a new detail into the hackers who in 2016 had breached the Arizona and Illinois state boards of elections: The same intruders had also spoofed emails from a voting technology company, VR Systems, in an attempt to trick more election-related victims into giving up their passwords.