DEFENDANT RECORD
Yuriy Sergeyevich Andrienko
fugitive
Aliases: andrienko
GRU Unit 74455 military officer who developed components of the NotPetya and Olympic Destroyer malware.
Key Facts
Status
FUGITIVE
Current legal state
Sentence
N/A
Pending / None
Restitution
$0
Mandatory restitution
Cases
2
Federal dockets
- Legal Disposition: fugitive.
- Nationality: Russian Federation.
- Total Imprisonment: Pending / None.
- Court Restitution: None ordered.
Prosecution Matters & Evidentiary Summary
Docket 2:20-cr-00316 · U.S. District Court for the Western District of Pennsylvania
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
fugitive 2020-10-15
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
Target Sector: Energy, Healthcare, Government, Transportation · Loss: $10.0 billion
View full evidentiary dossier →
Docket 2:20-cr-00211 · U.S. District Court for the Western District of Pennsylvania
Ukraine Electrical Substation Cyber Warfare Blackout
charged 2015-12-23
First confirmed cyberattack to deliberately cause an electrical power grid blackout. Russian military GRU hackers infiltrated power distribution companies, hijacked SCADA human-machine interfaces (HMI), opened circuit breakers at 30 substations, and destroyed control systems with KillDisk.
Target Sector: Energy & Electric Utilities · Loss: $50.0 million
View full evidentiary dossier →
ATT&CK Techniques Cited in Linked Charges
T1485: Data Destruction T1190: Exploit Public-Facing Application T1021.002: SMB / Windows Admin Shares T1003: OS Credential Dumping T1566.001: Spearphishing Attachment T1055.012: Process Hollowing T1036.005: Match Legitimate Name or Location T1543.003: Windows Service T1499: Endpoint Denial of Service T1124: System Time Discovery T1566.001: Spearphishing Attachment T1078: Valid Accounts T1485: Data Destruction