2015-12 · month precision · incident
Ukrainian power-grid campaign
DOJ alleges destructive operations against Ukrainian infrastructure during December 2015–December 2016.
Ukraine · DOJ indictment allegation · source published 2020-10-19
Sandworm
No sourced public emblem in this profile.
research profile · reported nexus: RU (not nationality)
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage
Source-reported aliases: Quedagh, VOODOO BEAR, TEMP.Noble, IRON VIKING, G0034, ELECTRUM, TeleBots, IRIDIUM, Blue Echidna, FROZENBARENTS, UAC-0113, Seashell Blizzard, UAC-0082, APT44, SANDWORM RELIC, UAC-0145. Associations do not prove equivalence.
Kinwilder analysis
Separate access activity from destructive effects and distinguish technical findings from geopolitical interpretation. Validate recovery paths and offline copies before an emergency. Historical destructive campaigns are context, not proof of a current incident or a specific operator.
Target geography
Catalog-listed countries (associations, not attack counts): 
Russia · 
Lithuania · 
Kyrgyzstan · 
Israel · Ukraine · 
Belarus · 
Kazakhstan · 
Georgia · 
Poland · 
Azerbaijan · 
Iran
No bound claim-post feed for this label.
Historical casebook
2017-05 · month precision · incident
French election campaign
DOJ alleges April–May spearphishing and disclosure operations against French political targets.
France · DOJ indictment allegation · source published 2020-10-19
2017-06-27 · day precision · incident
NotPetya
DOJ attributes this destructive outbreak to the charged GRU operators. The indictment identifies U.S. victims.
United States of America · DOJ indictment allegation · source published 2020-10-19
2018-02-09 · day precision · incident
Olympic Destroyer
DOJ alleges destructive interference with the PyeongChang opening ceremony.
South Korea · DOJ indictment allegation · source published 2020-10-19
2018-04 · month precision · incident
Novichok investigation targeting
DOJ alleges spearphishing against OPCW and the UK defence laboratory. UK geography refers to DSTL.
United Kingdom · DOJ indictment allegation · source published 2020-10-19
2019 · year precision · incident
Georgian institutions targeted
DOJ alleges parliamentary compromise attempts and website defacements in Georgia during 2019.
Georgia · DOJ indictment allegation · source published 2020-10-19
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
2026-10-31: When the outage is the objective. What distinguishes recovery interference from data encryption in the public record?
References
https://attack.mitre.org/groups/G0034/
https://dragos.com/blog/crashoverride/CrashOverride-01.pdf
https://www.us-cert.gov/ncas/alerts/TA17-163A
https://attack.mitre.org/groups/G0034
https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
https://dragos.com/adversaries.html
https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine
https://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine
https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back