Google reveals new details about Russia-linked “Sandworm” hacking group behind NotPetya, the attacks on Winter Olympics, French election, and more
and compromised — the Macron campaign: https://www.wired.com/... pic.twitter.com/P2SzFdBEqR
Context & Ripple Effects
Google's Threat Analysis Group is publishing its own attribution of [[a:932664|NotPetya, the destructive worm that caused an estimated $10B+ in damages starting from Ukrainian targets]], alongside the Winter Olympics attacks and the breach of the Macron campaign during the French election — all tied to Russia-linked Sandworm.
The report lands in a documented sequence: a year later the [[a:959145|DOJ charged six Russian GRU officers for NotPetya, the Ukraine blackouts and the election and Olympics intrusions]], France later disclosed a multi-year Sandworm campaign against French entities running Centreon IT monitoring software, and Mandiant eventually linked the hacktivist front Cyber Army of Russia back to Sandworm itself. Google's disclosure is the private-intel layer of an attribution case that prosecutors and European governments were independently assembling.
First-order effects
- Google's Threat Analysis Group formally joins the attribution roster on Sandworm, putting the same actor behind NotPetya, the Olympics attacks, and the Macron campaign compromise in one public record — useful immediately to defenders mapping GRU infrastructure.
Second-order effects
- Government action follows the vendor trail: the DOJ indictment of six GRU officers and France's Centreon breach disclosure build directly on the campaign Google documents, converting private telemetry into legal and diplomatic pressure on Moscow.
Third-order effects
- If the pattern holds — Google TAG reporting, Mandiant unmasking proxy 'hacktivist' fronts like Cyber Army of Russia, states indicting — attribution of Russian military cyber operations becomes a standing pipeline from private labs to courtrooms, raising the cost of deniable wiper and election-interference campaigns.
The trend: Attribution of Russian state hacking is shifting from episodic government announcements to a continuous public-private pipeline in which Google's threat intelligence teams name the actors first and prosecutors formalize the findings.