In this commentary, the speaker explains why the U.S. Department of Justice’s decision to publicly charge six members of Russia’s military intelligence (GRU) unit—known as the Sandworm APT—represents more than a legal action. The charges serve as a strategic message to the global hacking community and to Russian state actors that the United States and its allies can attribute, track, and publicly expose nation‑state cyber operations, even when false‑flag tactics are used. The speaker outlines Sandworm’s high‑profile attacks, including the 2015 Ukrainian power‑grid outage and the 2017 NotPetya malware campaign, highlighting their political and retaliatory motivations. He then discusses the informal “rules of engagement” that have evolved since World War II among intelligence agencies, arguing that the DOJ’s indictment is a way of signaling which cyber activities are deemed unacceptable and warning that violations may trigger tit‑for‑tat responses. The talk concludes that while nation‑state actors possess unparalleled cyber capabilities, establishing informal norms is essential for managing the fifth domain of combat and guiding future security policy.
Chapters
The United States Department of Justice formally released charges against 6 Russian hackers. Now, what makes this unusual is these 6 hackers either are current or former members of the Russian GRU. That's Russia's military intelligence unit. These are nation-state hackers. Now, it's unusual for a couple of reasons. And we need to unpack this a little bit. So this team, which is affectionately known as the Advanced Persistent Threat Sandworm, goes by a couple of other names too, but that's how we kind of recognize it. These individuals, world-class hackers, they've got an incredible organization. And again, right, nation states hacking, that's expected. But what's unusual here is nobody ever believes that any of these 6 individuals will ever be stepping into a Western court, being arrested or anything like that. So why would the Department of Justice file charges and release details about the investigations? This is where it gets interesting. It really has to do with sending messages. And the first message that it's sending is letting the hacker community, right, the professional nation-state hackers, in Russia know that the United States and its allies can track their activities, specifically identify them, and attribute what they're doing to them, even when they try and do things like false flags and, you know, make it look like some other country or hacker group is actually doing the attacks. And this particular hacker group is pretty successful. They're the ones that shut down the power grid in Ukraine in the wintertime. When there was a conflict, and there still is, between Ukraine and Russia. They were the ones that released NonPetya, one of the most damaging pieces of malware that went across the globe, right? $10 billion worth of damages, at least, right? So these guys know what they're doing, and they're funded, they've got the skills, the talents to make things happen. And from all accounts, especially if you read what the Department of Justice is saying, In some cases, they're doing it for specific political goals. In other cases, it's just kind of retribution, kind of schoolyard, I'm gonna pay you back because you're not allowing us to participate in the Olympics or something like that, or you're doing an investigation on a potential assassination that Russia sanctioned, things of that sort. So the other thing that we really have to understand as part of this, subtle communication is what are the acceptable rules of engagement? Now, after World War II, the CIA and the DIA and their counterparts, the KGB and the GRU, they had developed rules of what was okay to do and what was not okay to do. And this isn't a formal agreement that you sit down and sign. It's communicated through messages kind of like this. And so when the Department of Justice outlines and says, hey, wait a second, this group took down critical infrastructure of another nation state, this group, you know, went off and released malware that probably got out of hand and caused tremendous impact across the globe, right? That's kind of a message saying those kind of activities are not okay. They're just not. Now, again, every major country in the world weaponizes, right, cyber, offensive cyber skills. They weaponize their cyber capability. It's considered the fifth domain of combat, if you think about it. And there have to be rules though. And no country is gonna, you know, that has that capability, that advantage, is gonna wanna go off and sign some international treaty that says we won't do anything. And even if they do, they'll probably still do some things in the background. We saw this after World War II, right? During the Cold War, things would happen in the government intelligence agencies back and forth, but there were still rules. Post-Cold War, after détente, right, things got better. But now we've kind of slipped back and we're at tensions again with intelligence organizations of major countries, East and West. So this, I believe, is one of those informal ways of saying, hey, we're also going to do something. Some things are allowable, some things are not. Arguably, Russia has probably weaponized this type of capability better than any other country out there, including the US, although the US does have that capability, it's widely known. But again, coming out and saying, we're gonna charge these people and making it very public. Sends that message of, okay, let's figure out what's okay to do. And if you do something that crosses the line, we may then counter that by doing something very similar to you, tit for tat. So this is an important discussion that's indirect, but I think all of us, especially in the security community, need to understand, hey, we're never gonna see these people in an American court. It would be highly unlikely, be great, but highly unlikely. This is really about sending messages back and forth. And that's kind of important in what we do and how we do it moving forward, because nation states above all other threat actors have the most resources, capability, and flexibility when it comes to laws to conduct offensive cyber operations. So even informal rules need to be established. This is what we're seeing.
