Andy Greenberg's Sandworm

Andy Greenberg’s Sandworm tells the story of a long-running, unusually reckless campaign of cyberattacks traced to Russia’s military intelligence apparatus. Rather than treating hacking as a niche, technical subculture, the book frames it as a modern instrument of state power—one that can switch off electricity, break industrial machinery, and spill into everyday civilian life. Greenberg follows investigators across government agencies, private security firms, and Ukraine’s embattled infrastructure as they try to understand a threat that doesn’t look like traditional espionage. The adversary isn’t simply stealing secrets; it’s practicing for disruption and, at times, outright sabotage.

The narrative is anchored by a central idea: Ukraine became the proving ground for a new kind of cyberwar. What begins as targeted intrusions and destabilizing digital vandalism evolves into operations that blend intelligence gathering, psychological pressure, and attacks on the physical world. Greenberg presents these events not as isolated episodes, but as a campaign with momentum—each operation teaching the attackers what works, revealing the defenders’ blind spots, and raising the stakes.

The People Chasing a Ghost

These defenders are portrayed as both highly capable and constantly outmatched by the scale of the problem. They must make judgments with incomplete evidence and under pressure: is a strange crash just a bug, or the first tremor of something bigger? Should a company disclose an incident and risk reputational damage, or keep quiet and hope it doesn’t return? Greenberg emphasizes that cyber defense is often less like solving a puzzle and more like firefighting in a building where the floor plan keeps changing.

Ukraine as the Testing Ground

Greenberg positions Ukraine as the place where the attackers refine their playbook. The book explains how Ukraine’s geopolitical position, historical conflict with Russia, and infrastructure vulnerabilities made it an attractive target. More importantly, the attacks there were not merely symbolic. They were experiments—ways to learn how to interrupt real services and to do so repeatedly.

Ukraine’s defenders, in turn, become some of the most battle-hardened responders in the world. Greenberg describes an ecosystem where local engineers, government teams, and international partners coordinate under extraordinary pressure. The country’s experience becomes a warning: what happens in a “peripheral” conflict zone can migrate outward, especially when the same internet-connected technologies run power grids, shipping terminals, hospitals, and corporate networks across the globe.

BlackEnergy and the First Power Grid Shock

One of the book’s early focal points is the use of malware associated with campaigns that targeted Ukrainian organizations and infrastructure. Greenberg describes how intrusions that looked like typical espionage—phishing emails, footholds in corporate networks, stealthy persistence—began to connect to something more dangerous: interference with systems that control physical processes.

The power grid incidents become a watershed. The idea that hackers could remotely turn off electricity is no longer theoretical. Greenberg walks through how attackers penetrated the networks of utility companies, moved laterally, and interacted with operational technology environments. The chilling part is not only that the lights went out, but that the operation appeared deliberate and coordinated—suggesting rehearsals, planning, and an understanding of how to cause maximum disruption with limited time.

The Rise of a More Aggressive Toolset

As Sandworm progresses, Greenberg illustrates a pattern: each wave of attacks becomes more audacious. The attackers broaden their targets, refine their code, and demonstrate a willingness to cause collateral damage. The book shows how security researchers begin to recognize distinct families of malware and tooling—software designed not only to infiltrate but also to destroy or disrupt.

This period is defined by a growing realization that the threat actor is not constrained by the typical goals of cybercrime (profit) or classic espionage (information). Instead, the operations often appear designed to undermine confidence, create chaos, and signal capability. In other words, these are strategic attacks meant to intimidate and destabilize, not merely to steal.

Greenberg also conveys the uncomfortable asymmetry: defenders must secure everything, while attackers need only find one path in. Even when defenders patch, hunt, and harden their systems, they remain exposed to human error, legacy technology, and organizational complexity. The attackers exploit those realities repeatedly.

NotPetya: The Worm That Escaped

The book’s centerpiece is NotPetya, a catastrophic malware outbreak that began in Ukraine and rapidly spiraled into global damage. Greenberg describes it as a turning point for how the world understands cyber risk: a state-linked attack that functioned like a weaponized disaster. It masqueraded as ransomware, but the real outcome was destruction—systems rendered unusable, businesses paralyzed, and recovery measured in weeks or months.

The narrative here is both technical and cinematic. Greenberg follows how the malware spread using multiple mechanisms, including leveraging trusted software update channels and exploiting network vulnerabilities. The emphasis is on speed and scale: once unleashed, it moved through corporate networks with alarming efficiency, hopping across international subsidiaries and partner connections.

What makes NotPetya so memorable in Greenberg’s telling is the mismatch between intent and impact. Even if the primary target was Ukraine, the blast radius encompassed multinational corporations, shipping, logistics, manufacturing, and more. The incident becomes a case study in how interconnected systems turn a regional cyberattack into a worldwide economic event. It also becomes a warning: when attackers build tools that propagate autonomously, they surrender some control over where the damage lands.

Damage, Recovery, and the Corporate Wake-Up Call

After NotPetya, Sandworm shifts into the aftermath: the frantic efforts inside companies to restore operations, rebuild networks, and quantify losses. Greenberg highlights that many victims were not careless; they were normal organizations relying on standard network architectures and common software dependencies. That’s the point: modern business is built on complex, interlinked systems, and a shock to one part of that ecosystem can cascade far beyond the original target.

The book also captures the psychological impact. Incident responders are forced into triage mode, making impossible calls about what to restore first and how to operate safely while the scope of compromise is still unclear. Executives who previously treated cybersecurity as a technical cost center suddenly confront it as operational survival. The lesson isn’t just “patch faster” or “buy better tools.” It’s that resilience—backups, segmentation, practiced recovery—matters as much as prevention.

Greenberg uses these stories to show a broader shift in the corporate world’s understanding of cyber threats. The danger is not limited to intellectual property theft or embarrassing leaks; it includes the possibility of complete operational shutdown.

Industrial Sabotage and the Fear of the Next Step

Another chilling thread in Sandworm is the evolution from disruption to potential industrial sabotage. Greenberg describes efforts by investigators to understand malware that targets industrial control systems directly—tools that interact with the software used to manage physical processes in power grids and other industrial environments.

The implication is stark: if attackers can manipulate these systems, they can do more than cause blackouts. They can damage equipment, create unsafe conditions, and produce effects that take far longer to repair than a rebooted server. Greenberg treats this not as science fiction, but as an emerging reality demonstrated by real code and real operations.

This section reinforces the book’s central warning: cyberwar doesn’t have to look like missiles and tanks to be strategically meaningful. It can be quiet, deniable, and persistent—until it suddenly becomes very loud.

Attribution, Politics, and the Limits of Public Proof

Greenberg also explores how difficult it is to translate technical certainty into public accountability. Security researchers may see patterns that strongly indicate a specific actor, but governments must weigh what they can disclose without exposing intelligence sources or methods. Meanwhile, the accused can deny everything, muddy narratives, and exploit the complexity of cyberspace to sow doubt.

The book doesn’t pretend attribution is impossible; it shows how it’s done. But it also emphasizes that attribution is rarely a single smoking gun. It’s a mosaic of indicators, sometimes supported by rare moments of direct evidence. The political layer matters because consequences—sanctions, diplomatic action, deterrence—depend on convincing audiences that the case is real.

This tension leaves defenders in a strange position: they may be fighting a state-backed adversary, but the response mechanisms are slower, more cautious, and constrained by public standards of proof.

What “Sandworm” Ultimately Argues

By the end, Sandworm reads as both a narrative history and an argument about the future. Greenberg’s core message is that the world has entered an era where state cyber operations can cause widespread, real-world harm—and that the boundary between “cyber incident” and “national security crisis” is thin.

The book suggests several implicit takeaways. First, critical infrastructure and large enterprises are no longer dealing with hypothetical threats; the tactics are proven and repeatable. Second, interconnectedness is a vulnerability multiplier: shared software suppliers, flat networks, and global dependencies can turn one nation’s crisis into everyone’s problem. Third, deterrence in cyberspace is complicated, and the lack of immediate consequences can encourage escalation.

Yet the story isn’t purely bleak. Greenberg also highlights the progress made by defenders: better intelligence sharing, more mature incident response, and a clearer understanding of how operational technology needs to be secured differently from standard IT. The people in the book are not helpless. They learn, adapt, and, in many cases, keep essential systems running under extraordinary pressure.

Closing Note

In a casual but professional tone, Sandworm can be summed up as a true-crime-style account of cyberwar maturing in real time. It’s about the investigators who track a dangerous adversary, the Ukrainians who endure repeated digital assaults on daily life, and the rest of the world that slowly realizes it’s connected to the same battlefield. Greenberg’s story leaves readers with a practical sense of what modern cyber conflict looks like—and an unsettling awareness that the most damaging attacks may not be the ones aimed at them directly, but the ones that spill over when the digital weapons are set loose.