The link between Sandworm and a Cimplicity file that phoned home to a server in Sweden was enough for Wilhoit to come to a startling conclusion: Sandworm wasn’t merely focused on espionage. Intelligence-gathering operations don’t break into industrial control systems. Sandworm seemed to be going further, trying to reach into victims’ systems that could potentially hijack physical machinery, with physical consequences.
