Pod Insights The Vergecast Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers About this episode Verge editor-in-chief talks with Wired senior editor Andy Greenberg, author of Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers.
Greenberg's book is all about a group of hackers inside the Russian government called Sandworm, who were responsible for damaging cyber warfare attacks in various countries over the past few years.
Andy and Nilay discuss the origins of Sandworm, the intricacies of their attacks, and how they escalated what we think of as "cyber war."
Learn more about your ad choices. Visit podcastchoices.com/adchoices
Transcript Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.
0:01 Speaker 00 This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses set up required. Compatibility and availability varies 18 plus.
0:27 Speaker 01 I'm Ina Garten, and each week on Happy Hour, I invite new and old friends for a drink and a fun conversation at my kitchen table in New York City. On this week's episode, I'm joined by Nathan Lane. We talk about his critically acclaimed run in Death of a Salesman, Taking His Dog to Therapy, and winning an Emmy for Only Murders in the Building. New episodes of Happy Hour are available every Wednesday. You can watch on YouTube or listen wherever you get your podcasts. Cheers.
1:02 Nilay Patel? Hey, everybody. It's Sam from The Bridge Cast. On this week's interview episode, I talked to Andy Greenberg. He's a senior writer at Wired. He just wrote a book called Sandworm: A New Era of Cyber War and the Hunt for the Kremlin's Most Dangerous Hackers. It is all about a hacking group inside the Russian government called Sandworm. They were responsible for some of those damaging cyber warfare attacks over the past year. They were behind NotPetya, the hack that took out the mayor's shipping line, that took out hospitals across the UK. Sandworm has totally escalated what we think of as cyber war. Andy's book gets all into how they were discovered, how they were flushed out, the intricacies of these various hacks. This conversation was super interesting. The book is like a thrill ride. If you're looking for something that isn't the virus, this is like a thriller. I highly recommend it.
1:46 Nilay Patel? It was really fun to talk to Andy Greenberg about this stuff. One thing I want to note, we're all at home. So during this interview, you might hear some kids in the background. I ask you just be a little forgiving of that. We're all, we're all dealing with it. Andy was a great interviewer. Check it out. This is Andy Greenberg, author of Sandworm: A New Era of Cyber War and the Hunt for the Kremlin's Most Dangerous Hackers.
2:07 Nilay Patel? Andy Greenberg, you're senior writer at Wired. You're also the author of Sandworm: A New Era of Cyber War and the Hunt for the Kremlin's Most Dangerous Hackers. Welcome.
2:15 Speaker 03 Glad to be here.
2:16 Nilay Patel? So you've been writing about cybersecurity for a long time. I think you just said 2006 you've been writing about cybersecurity. But this book, Sandworm, as I was reading it, it seems like, I mean, it's what you call the new era of cyber war. It seems like there's been a huge turn in sort of state-sponsored, particularly Russian-sponsored, cyber attacks. How did you come on to that notion? How did you begin writing this book? I'm very curious how you see that turn happening.
2:41 Speaker 03 Well, in late 2016, my former colleague at Wired, Kim Zetter, she had been the one who really covered state-sponsored hacking and cyber war stuff, but then she left Wired. And this was also at the time when, you know, Russian hackers were meddling in the US election. They'd hacked the Democratic National Committee and the Democratic Congressional Campaign Committee and the Clinton Campaign. So my editors were really primed on state-sponsored hacking all of a sudden. But what they really, what they told me they wanted was a, actually like a big takeover of the whole magazine, all about cyber war. But, you know, cyber war, to me, is different than those kinds of espionage and election meddling tactics. So
3:22 Speaker 03 I went looking for, you know, a real cyber war story, which means to me like actual disruptive cyber attacks. And as I looked around, it seemed like the place where that was really happening was in Ukraine, not really in the US. In fact, maybe, you know, what was happening in Ukraine seemed to me like it was, in some ways, the only real, full-blown cyber war that was actually occurring, where Russian hackers were not just attacking the election, which they had done. They tried to spoof the results of a presidential election. But they had also, you know, attacked media and destroyed their computers. They had attacked government agencies and tried to like destroy entire networks. And then they had turned off the power for the first time.
4:03 Speaker 03 In December of 2015, the first actual blackout triggered by hackers. And just as I was looking into this, it happened again. The, in fact, the same hacker group caused a blackout, this time in the capital of Kiev. So I went looking in Ukraine for this cyber war story that, you know, turned into a cover story for Wired that kind of gave my editors what they wanted, but then also kept unfolding. I mean, this, this cyber war kept growing in scope and scale. And the original story I'd written for Wired was kind of about the fact that you could look to Ukraine to see the future of cyber war, that what was happening there might soon spread to the rest of the world. And that is actually what happens too.
4:45 Speaker 03 Like, just after we published that cover story, the same hackers released this climactic, terrible cyber attack in Ukraine, this worm called Natpetya, that spread beyond Ukraine and became the worst cyber attack in history, cost $10 billion. So when that happened, that was when, you know, I saw that there was the potential to do a book about this, that it was not just a kind of case study about Ukraine, or even a kind of predictive story, but a, an actual full story arc about this one hacker group that had carried out the, what I would say was not only the first real cyber war, but the worst cyber attack in history. And, you know, I wanted to capture the, the arc of that story and the effects and the real experience of cyber war.
5:28 Nilay Patel? Yeah. So the group is called Sandworm, and this is just one of the, the sort of opening arcs of the book, is how they've come, they come to be named this because of references in the code. Walk people through it. It's just like, it's so relatable that like, even these hackers are using, using this language that leads them to be called Sandworm. Tell people about it.
5:48 Speaker 03 Yeah. So when I started to look into the origins of this group, after that second blackout attack, I, I found that this, this company called Eyesight Partners, which had been acquired by FireEye, Eyesight Partners was the first to find these hackers in 2014, basically using phishing and a kind of typical espionage tactics to plant malware in the networks of very typical Russian hacking targets, like. Groups across Eastern Europe and NATO and it looked like what they were doing was just kind of typical espionage. They were planting this spyware called Black Energy. But, uh, well, first of all, they could see that they were Russian because they had this a server that they were using to administer some of these attacks. And they had left the server open so anybody could look at it.
6:33 Speaker 03 And there was a kind of Russian language how to file for how to use Black Energy on the server. So these guys seemed like they were Russian. But even more interesting in some ways was that they, to, to track each victim, each instance of Black Energy, this malware, had a little campaign code in it. And each campaign code was a reference to the science fiction novel Dune. And, you know, so like one of them was something about Arrakis. And then one of them is about the Sotarkars, these like imperial soldiers in, in that sci-fi universe. So I say partners named this group Sandworm because, uh, well, just because it was a cool like name associated with Dune, but it turned out to me, it became this very
7:14 Speaker 03 powerful name because the Sandworm is this monster that lies beneath the surface. And occasionally, you know, rises from underground to do terribly destructive things. And although I say partners didn't know that at the time, they, they soon afterward realized that what Sandworm was doing was not just espionage, but they were actually doing reconnaissance for disruptive cyber attacks. They were also hacking power grids. They were planting Black Energy, not only in these European and Eastern European targets, but in the US power grid networks as well. And then ultimately Sandworm was the first in 2015 to cross that line and, and use Black Energy as the first step in a multi-step attack that led to a blackout. So this was not just espionage.
7:59 Speaker 03 It really was a kind of like, you know, this monster that rises from under the ground to do terrible acts of like mass destruction that came to pass.
8:08 Nilay Patel? So one of the, the things that comes up over and over in the book is this growing sense of dread from security researchers and analysts.
8:18 Nilay Patel? Oh, this is an imminent threat to the United States, not just Ukraine, but like this is happening here. And then there's a sense that the United States actually opened the door to this kind of warfare with Stuxnet, which was an attack on Iran. How did those connect for you? It seemed like there's a new rule of engagement, a new set of rules of engagement for cyber warfare that actually the United States sort of implicitly created with Stuxnet by attacking Iran.
8:45 Speaker 03 Yeah, I mean, I tried to highlight, clearly Sandworm are the real bad guys in this story. They are the actual hacker group that did these terribly reckless and destructive attacks that actually, in some cases, put people's lives at risk. I mean, in the kind of, in some parts of this story, they actually shut down medical record systems and I think, you know, may have cost people's lives with these cyber attacks. So they are the actual antagonists here. But I did also want to highlight the ways that the US government is partially responsible for the state of cyber war. And there are a few ways that that's true. I mean, first, the US opened the Pandora's box of cyber war with Stuxnet, this piece
9:25 Speaker 03 of malware that was used to destroy Iranian nuclear enrichment centrifuges. That was the first piece of malware that actually kind of caused that physical disruption and destruction. And we now see Sandworm doing the same thing in Ukraine and in fact, in some ways around the world. Also, you know, the US hordes these kind of zero-day secret hacking techniques, some of which were stolen and leaked and used by Sandworm. But then I think that the, in fact, the biggest way that I tried to highlight that the US is responsible or complicit or negligent here is that we did not call out what Sandworm was doing in Ukraine and say to Russia, we know what you're doing. This is unacceptable.
10:10 Speaker 03 Nobody should be turning out the lights to civilians with cyber attacks. There was no message like that. I mean, the Obama White House sent a message to Russia over this kind of cyber hotline to say, your election hacking is not okay and we see what you're doing and we want you to stop. But they said nothing about... Uh, two blackout attacks in Ukraine. And that was a kind of implicit signal to Russia that they could keep escalating. And even as all of these cybersecurity researchers and Ukrainians were warning that what was happening to Ukraine would soon spread to the rest of the world. The US government did, you know, ignored this, both Obama and then the Trump administration, until that prediction came to pass and a sandworm cyber attack did spread to the rest of the world.
10:54 Speaker 03 And it was too late and we all suffered globally as a result.
10:58 Nilay Patel? So let's talk about Napetia. It, Napetia was catastrophic in scope, right? It took out the Maersk shipping line, which is a massive business. It took out some hospitals in the UK, like it was huge in scope. I don't think people really put it all together. Talk about how it started and how big it grew.
11:16 Speaker 03 Yeah, so Napetia was the kind of like big apotheosis of Sandworm, where all of these predictions of the terribly destructive things they were doing, spreading to the rest of the world came to pass. But it did, so it started in Ukraine. They hijacked this, the, the software updates of this accounting software called Medoc that is basically used by everybody in Ukraine, sort of like the Quicken or TurboTax of Ukraine. If you do business in Ukraine, you have to have this installed. So Sandworm hijacked the updates of that and used it to push out this worm to thousands of victims, mostly in Ukraine, but it was a worm. So it spread immediately and it very quickly kind of carpet bombed the entire Ukrainian internet.
11:59 Speaker 03 Every computer it spread to, it would, it would encrypt permanently. You could not recover the computer. So it very quickly took down pretty much every Ukrainian government agency, 22 banks, multiple airports, four hospitals in Ukraine that I could count. And in each of these cases, what I say, it took them down. And I mean, it destroyed essentially all of their computers, which requires sometimes weeks or months to recover from. But then, as you know, this is a worm that does not respect national borders. So even though it was, it seemed to be an attack intended to disrupt Ukraine, it immediately spread beyond Ukraine's borders to everybody who had this accounting software installed that was doing business in Ukraine and some people who didn't.
12:39 Speaker 03 So that included Maersk, the world's largest shipping firm, and FedEx and Mondelez, which owns Cadbury and Nabisco, and Bankers, this manufacturing firm that makes Tylenol, and Merck, the pharmaceutical company in New Jersey. Each of these companies lost hundreds of millions of dollars. The scale of this is kind of difficult to capture. But in the book, I try to, I focus in part on Maersk because it is just a, you know, it's a good company to look at because you can, they have this gigantic global physical machine that is, you know, they have 76 ports around the world that they own, as well as these massive ships that have tens of thousands of shipping containers on them.
13:24 Speaker 03 And I tell the story of how, on this day, 17 of their terminals were entirely paralyzed by this attack with, you know, ships arriving with just gargantuan piles of containers on them that nobody could unload. Nobody knew what was inside of them. Nobody knew how to load or unload them. With around the world of these 17 terminals, thousands of trucks, semi-trailers carrying containers were lining up in lines miles long because the gates that were kind of the checkpoints to check in the, these trucks to drop something off or pick it up, they were paralyzed as well. This was like a fiasco on a global scale. Maersk is responsible for a fifth of the world's global shipping capacity and they
14:07 Speaker 03 were truly just rendered brain dead by this attack. But yeah, this played out in all of these different victims. Merck had to borrow their own HPV vaccine from the Center for Disease Control because their manufacturing was disrupted by this. And it ultimately spread to a company called Nuance that makes speech to text software. They have a service that does this. For hospitals across the US. So dozens of or possibly hundreds of American hospitals had this backlog of transcriptions to medical records that were lost because of this. And that resulted in patients being due for surgeries or transfers to other hospitals. And nobody knew if their medical records were updated.
14:52 Speaker 03 I mean, this was at a scale where, you know, hundreds of hospitals, each of which has thousands of patients missing changes to medical records. We don't know what the effects of that were, but it very well could have actually harmed people's health or lives. I mean, the scale of NAPETIA is very difficult to just get your mind around. But we do know that, you know, monetarily, it cost $10 billion, which is by far the biggest number we've ever seen. But it also had this, you know, this kind of harder to quantify toll on people's lives.
15:23 Nilay Patel? So it, you know, you obviously wrote about it at length in Wired. Obviously, these companies go down, it sort of ripples in the mainstream sort of general press. But I don't feel like people really know, like, oh, this Russian group called Sandworm, sponsored by the Russian government, unleashed this attack and it caused this cascading effect of failure and disaster and cost. And that, because we know we can attribute it to the government, our government should respond. Like, I don't feel like that connection got made for people. What is the gap between, oh, there was a hack and, oh, this is actually a type of warfare engagement?
16:02 Nilay Patel? Because that, that connection seems very tenuous, I think, for a lot of people, even as sort of the more general mainstream press covers the stuff.
16:09 Speaker 03 Yeah, I, you know, I don't think that that is just like the nature of cyber war. I think that was a failing, that that lack of connection is a failing on our government's part. And on, you could say even on the part of some of these victims, like these large companies. I mean, I, at the time that NAPETIA happened, I was fully on the trail of Sandworm. And within days, I was talking to cybersecurity researchers who had pieced together some of the forensics to show that NAPETIA was Sandworm, that it was a Russian state-sponsored cyber attack. And yet, none of those companies That I mentioned like Merk or Mondelez or Maersk or FedEx or any of them wanted to say that Russia had done this to them.
16:49 Speaker 03 And no governments were talking about it either, like the Ukrainian government was, they're always willing to point the finger at Russia. But the US government was not, and you know, that to me seemed to be just kind of. I mean, I felt like I was being gaslit at that point, like I had watched Russia do this to Ukraine for a long time at that point. And I I sort of understood that NATO and the West, we had this kind of cruel logic that, you know, Ukraine is not us. You know, Russia can do what it likes to Ukraine because they're not NATO, they're not EU. They are Russia's sphere of influence or something. I think that that's very wrong headed, but at least it made sense, you know, to have that that viewpoint.
17:31 Speaker 03 But now this attack had spread from Ukraine to hit American soil, American companies in many cases. And yet still, the US government was saying nothing. I just thought this was bizarre and, you know, so I. For months, I was like trying to get any of these companies to tell the story of of their experience of NAPETIA. I was trying to figure out why the US government wasn't talking about the fact that this was a Russian cyber attack. And ultimately, I think it was, I think it was kind of, I don't know, partly disorganization and negligence. I think it may have something to do with the fact that the Trump administration doesn't like talking about Russian hackers for obvious reasons.
18:12 Speaker 03 But eight months after, it took eight months ultimately for the US government to finally say NAPETIA was Russia. It was the worst cyber attack in history. And then a month later, the White House imposed consequences and, you know, put new sanctions on Russia in response. But it took nine months and more importantly, it took, you know, multiple years. This was, that was the first time, this was February of 2018. And the Russian cyber war in Ukraine had started around the fall of 2015. So that's just an incredible span of negligence when the US government said nothing about these escalating unfolding.
18:50 Speaker 03 Acts of cyber war that should have been unacceptable from the very beginning. I mean, these are the kind of quintessential acts of state-sponsored cyber attacks on civilians, turning out the lights, you know? That's the kind of thing that I believe that the US government should have called out and, you know, drawn a red line across at the very beginning, and it took years. So I do think it was a big failing of diplomacy.
19:15 Nilay Patel? It does seem like that part of the problem, and this is kind of my next question is, it's so hard to describe, like if the Russian government sent fighter jets to America and blew up America port, okay, like everyone understands, you can see it, you can understand what happened there in the, you know, there's like however many decades of movies about how to fight that war. This is a bunch of people in a room typing, right? Like, there's just an element of this where the danger is so ephemeral, where the attack is invisible, and that while the effects might be very, very tangible, the causes are still sort of mysterious to people. So my question is like, who is Sandworm? What do we know about them? Where do they work? What are they like?
20:00 Nilay Patel? Do we have a sense of how this operation actually operates?
20:03 Speaker 03 That was in some ways the biggest challenge of reporting this book, and I spent essentially the third act of the book, the last third of the reporting of the book, trying to answer this question of who is Sandworm? Who are these people? Where are they located? What motivates them? And I guess to partially spoil the ending here, they are a unit of the GRU. They are a part of Russia's military intelligence agency, which is responsible for, you know, this is not a coincidence, they are responsible for election meddling, they're responsible for the attempted assassination of Sergei Skripal with, you know, chemical weapons in the United Kingdom, they're responsible for the downing of MH-17, a commercial passenger
20:46 Speaker 03 jet over Ukraine where 300 innocent people died. The GRU are this incredibly reckless, callous military intelligence agency, but they act like kind of almost just cutthroat. mercenaries around the world doing Russia's bidding in ways that are, I think, very scary. So I threw essentially like a combination of excellent work of a bunch of security researchers who I was speaking to, combined with some confirmation from US intelligence agencies. And then ultimately, some other clues from the investigation of Robert Mueller into election meddling. All of these things combined created a trail that led to one group within the GRU.
21:31 Speaker 03 There were, you know, I eventually had some names and faces and even an address of this this group. And all of that was actually only finally fully confirmed after the book came out, just in in recent months. When the White House finally, actually it was the State Department's and as well as the UK and Australian and other governments together finally said, yes, sandworm is in fact this unit of the GRU. So this theory that I developed and posited near the end of the book was finally basically confirmed by governments just in recent months.
22:06 Nilay Patel? So one thing that strikes me about that is I think of the Russian military. I think the GRU is being foreboding, being, obviously, they're very, very good at this. They're very buttoned up. And then they have like an incredible social media presence that kind of pops up throughout the book that distracts from what they're doing. They set up Guterfer 2.0 when they were doing the DNC hacks that fed to WikiLeaks. And that account insisted it was just a guy. They set up the shadow brokers, which was this, I read it as just like, here are some goofballs. Like, they wanted to seem a lot dumber and a lot smaller than they were, and they were very effective at it. Have people, first of all, talk about those, that strategy.
22:48 Nilay Patel? And then I guess my, the question I had is like, are we better at seeing that strategy for what it is?
22:53 Speaker 03 Well, you make a really interesting point. I mean, the GRU uses these false flags like throughout their recent history. But I should say, we don't know that they were responsible for Shadow Brokers. In fact, we don't, nobody knows who Shadow Brokers, the Shadow Brokers truly are. And they are in some ways, the biggest mystery in this whole story. There's one group that hacked the NSA, apparently, and leaked a bunch of their zero-day hacking techniques. Or maybe they were even NSA insiders. We still don't know the answer to that question. But the other incidents you mentioned, they are, the GRU are responsible for this Guccifer 2.0 fake activist that leaked a bunch of the Clinton documents. They're responsible
23:34 Speaker 03 for other false flags. Like, they at one point called themselves the Cyber Caliphate, pretended to be ISIS. They have pretended to be like patriotic, pro-Russian Ukrainians at some points. They, they're always like wearing different masks, and they're very deceptive. And then in the, in the later chapter of the book, that some of the biggest, one of the biggest attacks they did was this attack on the 2018 Olympics, where they not only wore a false mask, but they actually had layers of false flags, where as cybersecurity researchers dug into this malware that was used to destroy the entire backend of the 2018 Winter Olympics, just as the opening ceremony began. I mean, this was a catastrophic
24:18 Speaker 03 event. The malware had all of these fake clues that made it look like it was Chinese, or North Korean, or maybe Russian, but we, nobody could tell. And it was like, it was this kind of confusion bomb, almost designed to just make researchers throw up their hands and give up on attributing the malware to any, you know, particular actor. And it was only through some amazing detective work by like some of the analysts that I spoke to, that they were able to cut through those false flags and identify that Sandworm was behind this, essentially. But yeah, it's, it is a, one very real characteristic of the GRU, that they are almost, they seem to almost take pleasure, or like be showing
25:00 Speaker 03 off their deception capabilities too. And they're evolving those capabilities. I mean, they are getting more deceptive over time, as they gets more destructive and aggressive.
25:15 Speaker 00 This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration blog, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses set up required. Compatibility and availability varies 18 plus.
25:41 Speaker 04 Everyone's talking about the prospect of a democratic wave in the midterm elections. But here's something that matters just as much. The battle to control state legislatures.
25:51 Speaker 05 That's the most important thing we should be focusing on right now.
25:54 Speaker 04 The GOP has a trifecta in 23 states, which means they control the governor's seat, plus the state house and the state senate. For Democrats, it's 16 states.
26:05 Speaker 05 Meaning that the opportunity to pass the policies that the majority of our state supports, things like increasing minimum wage, legalizing marijuana, codifying abortion.
26:16 Speaker 04 If Democrats flip just a handful of state legislatures, the majority of Americans will now live in a state under full democratic control, which could have big policy implications.
26:27 Speaker 05 That's all on the table with the Democratic trifecta.
26:30 Speaker 04 This week on America Actually, we're in Wisconsin and we talked to Francesca Hong.
26:34 Speaker 05 We have an opportunity through Wisconsin to actually start improving the brand for Democrats.
26:41 Speaker 04 Catch us every Saturday on YouTube or wherever you get your podcasts.
26:47 Nilay Patel? You know, I love to play the game of like, imagine the meeting. And you imagine that the one set of meeting, which is like the actual hackers finding the vulnerabilities, figuring out how to jump from a Windows 8 computer to some sort of physical hardware controller that actually runs a terminal. Like, that's a very hard problem in and of itself. And then there's like the other meeting where they're like, what we're gonna do is claim to be a guy called Guterre 2.0. And like, those aren't, they're not connected, right? But the way they, throughout the book, the way they execute these campaigns, they're deeply connected. And that seems like not only just a new kind of warfare, a new kind of craft, but something that just consistently seems to work.
27:32 Nilay Patel? In like surprising ways, like the tech press is gonna be like, "Gucha first says this." And we're, there's never that next step of, "Also, we think it's the Russian government." And that seems like, first of all, I'm dying to imagine the meeting. I would love to be a fly on the wall of the meeting where they decide what their Twitter name is gonna be today. And then I would, I'm very curious how they evolved those attacks in such a way that it just seems to be more and more effective over time.
27:58 Speaker 03 Yeah, I mean, I would also love to have been in those meetings. And, you know, I, it's my one kind of regret in this book that I never actually got interviews. I mean, it's almost an impossible thing to do, to like find defectors from the GRU or something who will tell those stories and then not get murdered. I mean, it's just kind of impossible. But, but yeah, and in some cases, you know, I think to your earlier point, they almost seem kind of bumbling in these things. Like, they do them in a very improvisational way. And Gucha for 2.0 seemed almost like it was just this thing they invented on the spot to try to cover up some of the accidental slip-ups. Like, they had left Russian language formatting errors in the documents that they had leaked from the DNC.
28:43 Speaker 03 So they invented this guy who appeared the next day and started, you know, talking about being a Romanian. And then my friend at Motherboard, Lorenzo Franceschi-Bicari, he started this conversation online with Gucha for 2.0 and basically proved that the guy could not actually properly speak Romanian and seemed to probably be a Russian speaker. In fact, I mean, it was, it was almost comical. You know, at the same time, they're using very sophisticated hacking techniques. They're doing destructive attacks on a massive scale. But they're also just, they seem like they're kind of making up as they go along. They do things that don't actually seem very kind of strategically smart. They kind of seem like they're just trying to impress their boss for the day.
29:26 Speaker 03 Sometimes with just like some, sometimes it just seems like the GRU wakes up and asks themselves, like, "What can we blow up today?", rather than thinking like, "How can we accomplish the greater strategic objectives of the Russian Federation?", you know? So they are fascinating in that way and a very strange and colorful group.
29:45 Nilay Patel? That's, I think, one of the biggest questions I have here is, we spend a lot of time trying to imagine what Vladimir Putin wants, you know, when he grows up. But it, none of this seems targeted. Like, What is the goal for Russia to disrupt the Winter Olympics? Right? Like, is there a purpose to that? Is that just to strike fear? Is it just to expand that sphere of influence? Is it just to say, we have the capability, fear us? Is there, has there ever really been a stated goal for this kind of cyber warfare?
30:14 Speaker 03 That one is particularly mystifying. I mean, you can imagine why Russia would want to attack the Olympics. They were banned from the 2018 Olympics for doping. But then you would think that they might want to attack the Olympics and, you know, send a message, maybe like a deniable message, but a message that, you know, if you continue to ban us, we're going to continue to attack you like, like any terrorists would do. But instead, they attacked the Winter Olympics in this way that really seemed like they were trying not to get caught and to instead like make it look like it was Russia or North Korea. And then you have to wonder like, what is the point of that? Was it just so that they could kind of, you know, sit there in Moscow and kind of like rub their hands together and gleefully watch this chaos unfold?
30:58 Speaker 03 It almost really does seem like it was this petty vindictive thing that they just, for their own emotional needs, wanted to make sure that nobody could enjoy the Olympics if they were not going to enjoy them. That was, but that one is, I think, an outlier in some ways. For the most part, you can kind of see that Russia is advancing, that the GRU, that sandworm, is advancing something that does generally make sense, which is that in Ukraine, for instance, they're trying to make Ukraine look like a failed state. They're trying to make Ukrainians lose faith in their security services. They're trying to prevent investors globally from funneling money into Ukraine. They're trying to create a kind of frozen conflict, as we say, in Ukraine,
31:42 Speaker 03 where there's this constant perpetual state of degradation. They're not trying to conquer the country, but they're trying to create a kind of permanent war in Ukraine. And with cyber war, you can do that beyond the traditional front. And it is in some ways the same kind of tactic that they used in other places like the US, which, you know, here we saw it more as an influence operation, that they were hacking and leaking organizations like, you know, democratic campaign organizations and anti-doping organizations to kind of sow confusion, to embarrass their targets. They're trying to influence like the international audience's opinion of these people.
32:25 Speaker 03 But in Ukraine, it is in some ways just a different kind of influence operation, where they're trying to influence the world's view of Ukraine and influence Ukrainians' view of their themselves and their government to make them feel like they are in a war zone, even when they're in Kiev, hundreds of miles from the actual fighting that's happening on the eastern fronts in, you know, the eastern region of Ukraine.
32:47 Nilay Patel? So in a book, you go to Kiev, you spend time in Ukraine. Is there a sense in that country that, well, you know, sometimes the light goes out. Sometimes our TV stations, their computers don't boot anymore because they got rewritten, their hard drives got rewritten zeros. Like, is there a sense that this is happening? Is there a sense that they need to fight back? Is there, does Microsoft deploy, you know, dozens of engineers to help fight back? How does that play out on the ground there?
33:13 Speaker 03 Yeah, I mean, to be fair, Ukrainians are very stoic about these things. And regular Ukrainian citizens were not bothered by, you know, a short blackout. They didn't particularly care that, you know, this blackout was the first ever hacker-induced blackout in history. But Ukrainian cybersecurity people were very unnerved by this, and people in these actual utilities were, you know, traumatized. I mean, these attacks were truly relentless and very, you know, kind of scary for the actual operators at the controls. I mean, in the first blackout attack, these poor operators in a Ukrainian control room in western Ukraine, they were locked out of their computers and they had to watch their own mouse cursors click through circuit breakers, turning off the power in front of them.
33:58 Speaker 03 I mean, they watched it happen at these kind of phantom hands to control of their mouse movements. So they took this very, very seriously. But yeah, Ukrainians as a whole, I mean, they have seen a lot. They are going through an actual physical war. They've seen the seizure of Crimea and the invasion of the east of the country. You know, the day that Napetia hits, a Ukrainian general was assassinated with a car bomb in the middle of Kiev. So they have a lot of problems and I'm not sure that cyber war is the one at the top of their minds. But Napetia absolutely did actually reach Ukrainians, normal Ukrainian civilians too. I mean, it shook them as well. I talked to two regular Ukrainians
34:42 Speaker 03 who found that they couldn't swipe into the Kiev metro. They couldn't use their credit card at the grocery store. All the ATMs were down. The postal service was taken out for, every computer that the postal service had was taken out for more than a month. I mean, these things really did affect people's lives. But it kind of took until that kind of climactic worm, Napetia, for, I think, for this to really reach home for Ukrainians who have just kind of seen so much.
35:13 Nilay Patel? So how do you fight back? I mean, I, one of the things that struck me as I was reading the book is so many of the people you talk to, so many people who are identifying the threat, they're actually private companies. You know, eyesight was the first to even detect it. They are contractors to the intelligence agencies, the military in some cases, but they're not necessarily the government, right? Like, it's not necessarily Microsoft who has to, you know, issue the patches for the software, not necessarily GE, which makes Simplicity, which is the big industrial control software you talk about a lot. How does all of that come together into a defense? Because that seems like a harder problem of coordination.
35:50 Speaker 03 Yeah, yeah. I mean, defense in cybersecurity is an eternal problem. It's incredibly complicated. And when you have a really sophisticated and determined adversary, you know, they will win eventually. And, you know, I think that there are absolutely lessons for defense in this book about, you know, maybe you need to really, really think about software updates, for instance, like the kind that were hijacked with this MiDoc accounting software, as a vector for terrible cyber attacks. And imagine that, like, you know, any of your insecure apps that have these kinds of updates can be, become a piece of malware, essentially. You need to
36:33 Speaker 03 segment your networks. You need to think about patching. I mean, there are just an endless kind of checklist of things that every organization needs to do to protect themselves. So. In some ways, that's just like a Sisyphean task. And I don't, I don't try to answer that question in the book because it's just too big and it's kind of boring as well. But what I do really hammer on is the thing that the governments really could have done here, which is to try to establish norms, to try to control attackers through diplomacy, through kind of disciplinary action, through things like a kind of Geneva Convention for cyber war. If you think about a kind of analogy to say like chemical weapons, we could just try
37:15 Speaker 03 to give everyone in the world a gas mask that they have to carry around with them at all times. Or we could create a Geneva Convention norm that chemical weapons should not be used. And if they are, then it's a war crime and you get pulled in front of the Hague. And we've done the latter, you know? And I think that that in some ways should be part of the answer to cyber war as well. We need to establish norms and make countries like Russia or like, you know, organizations like the GRU understand that there will be consequences for these kinds of attacks, even when the victim is not the US or NATO or the EU. And I think we're only just starting to think about that.
37:56 Nilay Patel? One of the questions I had as I was reading it is, it seems like a very clear red line for almost everyone you talk to is attacks on the power grid, right? That is just unacceptable. You should not do it. If you do it, you've crossed a line and there should be some consequence. Is that clear to governments? Is that something that our government says, is it something that the EU says? Has that been established? It seems like it's, it's the conventional wisdom. Everyone wants it to be established, but I'm not unclear whether that is actually the line that exists.
38:26 Speaker 03 It definitely has not been established. And when I kind of did these, you know, I managed to get sort of exit interviews with the top cybersecurity officials in the Obama and Trump administration. J. Michael Daniel was the cyber coordinator for the Obama administration. And then Tom Bossert was the kind of cyber coordinator's boss and the Homeland Security advisor for Trump. And both of them, when I asked them about like, why, why didn't, you know, to put it bluntly, like, why didn't you? Responds when Russia caused blackouts in Ukraine. Both of them essentially said, well, you know, that's not actually the rule that we want to set. We want to be able to cause blackouts in our adversaries' networks and in their power grids.
39:09 Speaker 03 When we are in a war situation or when we believe it's in our, you know, national interest. So, you know, that's the thing about these cyber war capabilities. This is part of the problem that every country and absolutely the US among them. Isn't really interested in controlling these weapons because we in this kind of Lord of the Rings fashion. We are drawn to them too, like we want to maintain the ability to use those weapons ourselves. And, and you know, nobody wants to like throw this ring in the fires of Mount Doom. We all want to maintain the ring and imagine that we can use it for good, you know? So that's why neither administration called out Russia for doing this because we want that power too.
39:52 Nilay Patel? I hate to make the comparison to nuclear weapons, but sure, I'm gonna do it. We've negotiated drawdown treaties with Russia in the past. We count warheads, we're aware that the United States stockpile can destroy the world 50 times over today. And maybe tomorrow it's 100 times like what we have a sense of the the measure of force that we can. Put on the world when it comes to nuclear weapons, there's a sense that, oh, we should never use these, right? Like we have them as a deterrent, but we've gamed out that actually what it leads to is mutually assured destruction. Like there's an entire body of academics, there's an entire body of research, there's an entire body of. Scenario planning with that kind of weapon. Does that same thing exist for for cyber weapons?
40:37 Speaker 03 Yeah, there, there are absolutely whole, you know, communities of academics and policymakers. Who are thinking about this stuff now, but I don't think it's kind of gotten through to actual government decision makers. That there needs to be a kind of cyber deterrence and how that would work. And and the comparison to nuclear weapons is like instructive, but not exactly helpful. In fact, it's kind of counterproductive because we cannot deter cyber attacks with other cyber attacks. I don't think that's gonna work. In part because we haven't even tried to establish it yet. There are no kind of rules or red lines. But then I think more importantly, everybody thinks that they can get away with cyber attacks, that they can, they're gonna create a false flag that's clever enough that that
41:21 Speaker 03 when they, you know, blow up a power grid, they can blame their neighbor instead. So they think they're gonna get away with it, and that causes them to do it anyway, and not fear the kind of assured destruction. So I think that the the right response, the way to to deter cyber attacks is not with the promise of a cyber attack in return. It's with all the other, you know, kind of tools we have, and and they've been used sometimes, but but they were not in the case of Sandworm. And those tools include like sanctions, which came, you know, far too late in this story, indictments of hackers in some cases. We still haven't really seen Sandworm hackers indicted for the things that they did in Ukraine or or even Na'petia.
42:06 Speaker 03 And then ultimately, just kind of messaging, like calling out, naming and shaming bad actors. And that has happened to some degree with Sandworm, but in some cases, there have still been massive failures there. There has still been no public attribution of the Sandworm attack on the 2018 Olympics. I mean, my book, you know, has been out for months. I think I show pretty clear evidence that Sandworm is responsible for this attack. At the very least, it was Russia. And yet, the US and Korean, where you know, where this these Olympics took place, at the UK, none of these governments have named Russia as having done that attack, which almost just invites them to do it again whenever our next Olympics are going to be. I guess maybe not this year.
42:49 Speaker 03 But if you don't send that message, then you're just essentially inviting Russia to try again.
42:55 Nilay Patel? So I think my big question is, what happens now? I mean, right, you write about the NSA has tailored access operations, which is their elite hacking group. We are obviously interested in maintaining some of these capabilities. We've come to a place where people like you are writing books about how it works. What is the next step? What is the next turn of the script? Is it just, does it just keep getting worse? Or does this kind of diplomacy you're talking about, is that beginning to happen?
43:22 Speaker 03 I think there are some little glimmers of hope about the diplomacy beginning to happen. I mean, this year in February, I think it was, the State Department called out a sandworm attack on Georgia, where the sandworm hackers basically took down a ton of Georgian websites by attacking their hosting providers, as well as a couple of TV broadcasters. And the US State Department, with a few other governments, not only said this was sandworm, and they named the unit of the GRU that sandworm is. That was a confirmation that I'd been looking for for a long time. But they also made a point of saying that we're calling this out as unacceptable, even though Georgia, the country of Georgia, is not part of NATO or the EU. So that's progress.
44:06 Speaker 03 That's essentially creating a new kind of rule that state-sponsored hackers can't do certain things, no matter who the victim is. And that's really important. Also, it was kind of interesting because federal officials gave me a heads up about that announcement before it happened, which they very, very rarely do. And I think that they were trying some way to say, listen, we read your book and we got the message. Okay, like, stop attacking us about this. Like, we're trying, we're doing something different here. I don't want to flatter myself that I actually changed their policy, but it did seem interesting that they wanted to tell me personally about this. So I think that maybe our stance on this kind of diplomacy is evolving, and we're learning lessons.
44:50 Speaker 03 But at the same time, we also see the attacks evolving too. And there are new innovations in these kinds of disruption happening. We've seen since some of these terrible sandworm attacks, other very scary things, like this piece of malware called Triton or Trisys that was used to disable safety systems in an oil refinery in Saudi Arabia that could have caused an actual physical explosion of a petrochemical facility. The attacks are evolving too.
45:18 Nilay Patel? Okay, final, last, real question. Tell people where they can get your book.
45:23 Speaker 03 Yeah, you can find all kinds of places to buy it on andygreenberg.net.
45:27 Nilay Patel? Great. And you've you've written another book as well previously, yes?
45:30 Speaker 03 Yeah, that's right. I wrote a book about WikiLeaks and cypherpunks and things like that.
45:34 Nilay Patel? That's great. Well, I'm a huge fan. It was an honor to talk to you. Thank you so much for coming on. I know it's it's a weird time to be talking about anything but the coronavirus, but I was very happy to talk about something else, which is, yeah, it seems a little bit more in our control, even if it is quite dangerous. So thank you for the time. I appreciate it.
45:51 Speaker 03 Yeah, I'm glad to provide people with a different kind of apocalypse as a distraction.
45:58 Nilay Patel? All right. My thanks to Andy Greenberg. You can check out his book Sandworm. It's out everywhere. I really recommend it. I had a great time reading it. We'll be back on Friday with the chat show and we're going to keep going. Please tweet me at @Reckless. Love hearing from you. Who you want me to interview, what you want to talk about? I'll talk to you soon.
Previous Big tech antittrust hearing preview and the Xbox Games Showcase breakdown Next Tech antitrust hearing: the important moments and what comes next Page updated October 14, 2026 · transcript and summary are machine-generated
