Sandworm

In Sandworm, Andy Greenberg tracks a Kremlin-backed hacking group and argues that Western offensive hacking accelerated a global arms race. Its strength is linking intrusions to civilian outages.

The first known hacker-induced blackout began with a phishing macro and reached breaker controls through remote access. NotPetya entered through hijacked vendor updates for M.E.Doc, a Ukrainian tax program; stolen credentials and a leaked NSA exploit then spread it.

Olympic Destroyer carried conflicting clues; a Kaspersky researcher proved its North Korean-style header forged, discrediting one lead, while anonymous U.S. officials named the GRU without publicly verifiable evidence.

The final chapter turns to repair: Ukraine's postal service rebuilt subscription lists from paper cards, and Dan Geer argues independent fallbacks shorten recovery, though maintaining them costs resources.

Read it as 2019 history, tracing how attackers gained entry, how evidence was weighed and which fallbacks kept services running.