What is a Threat Actor? Tracking Sandworm's Transformation
summary
Tracks Sandworm from black energy (2006) cybercrime roots through a 2015 shift to sabotage (KillDisk) and 2016 adoption of bespoke tools like TeleBots, gcat and Indestroyer, then the 2018 Olympic Destroyer false‑flag operation; reports from ESET and Kaspersky argue splits into espionage and sabotage factions while DOJ indicts six actors in 2020. Claims: group morphs, borrows tooling and tradecraft, and plants deliberate overlaps to confuse attribution; implication: capability estimates and country‑level cyber power rankings may be systematically wrong.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:04Threat intelligence limits
- 7:26Tracking Sandworm’s evolution
- 17:20Sandworm’s possible splits
- 20:53Cyber conflict implications
- 23:26Q&A
related talks
26mThe Secret Life of Sandworms
40mThe Last Remaining Cover for Action
32mKeynote - Andy Greenberg's Reflections on Sandworm
10mBehind the Next Destructive Attack
42mKeynote: The Expanding Universe of Cyber Threats
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
51mReconsidering Ragnarok: The Cyber Threat Terrain After the Ukraine Invasion
09mDisrupting Cyber Adversaries: Meta's Approach to Deterrence