John Hultquist

Background

John Hultquist is an American cybersecurity researcher and threat intelligence analyst who has spent much of his career tracking state-sponsored hacking operations, particularly those linked to Russia's military intelligence service, the GRU. He built his career at a series of threat intelligence firms — iSight Partners, FireEye, and Mandiant — that were successively acquired by larger companies, culminating in Google's 2022 acquisition of Mandiant. By the mid-2020s he held the title of Chief Analyst at the Google Threat Intelligence Group (GTIG), the unit formed from Mandiant's threat intelligence practice within Google Cloud.

iSight Partners and the Sandworm Team

In 2014, researchers at iSight Partners, the threat intelligence firm where Hultquist worked at the time, identified a cyberespionage campaign exploiting a previously unknown Windows vulnerability, CVE-2014-4114, publicly disclosed on October 14, 2014. The campaign, which targeted NATO, Ukrainian government agencies, and other organizations, used malware whose source code contained references to Frank Herbert's science-fiction novel "Dune"; iSight researchers dubbed the group behind it "Sandworm Team." Hultquist subsequently authored an iSight Partners report dated January 7, 2016, titled "Sandworm Team and the Ukrainian Power Authority Attacks," which publicly connected Sandworm to a December 2015 cyberattack that had cut power to a large number of Ukrainian customers — one of the first confirmed cases of a cyberattack causing a blackout.

FireEye

iSight Partners was acquired by the security company FireEye in 2016, and Hultquist continued his threat-tracking work there, eventually holding the title of Director of Intelligence Analysis. In that role he was a public-facing voice on FireEye's research into state-linked hacking groups, including the Chinese espionage-for-hire group APT41, and on continued Russian operations against Ukrainian targets. He was frequently quoted by journalists explaining the significance of newly disclosed intrusions in the context of nation-state cyber conflict.

Mandiant and Google

FireEye's Mandiant division was later spun off as an independent company, which Google acquired in 2022. Hultquist served as Mandiant's Vice President of Intelligence Analysis, a role in which he continued to track Sandworm's activity, including its suspected role in the 2022 "Industroyer2" malware incident aimed at Ukraine's power grid, an attack that was detected and stopped by Ukrainian and international responders before causing a wider outage. Following Google's later reorganization of its threat intelligence functions, Hultquist became Chief Analyst of the Google Threat Intelligence Group, in which capacity he has continued to comment publicly on state-sponsored hacking campaigns, including Chinese cyberespionage operations such as the BRICKSTORM malware campaign reported in 2025.

Significance and Legacy

Sandworm has since been publicly attributed by U.S. authorities to Unit 74455 of Russia's GRU military intelligence agency and linked to further destructive operations, including the 2017 NotPetya malware outbreak, one of the most damaging cyberattacks in history. In October 2020, a U.S. grand jury indicted six alleged Unit 74455 officers on charges connected to this and other campaigns. Hultquist's early work at iSight Partners in identifying and reporting on the group, and his subsequent career-long focus on it across FireEye, Mandiant, and Google, made him one of the most consistently cited analysts in public reporting on Sandworm's operations.

Timeline

• 2014-10-14iSight Partners, where Hultquist worked, publicly discloses the CVE-2014-4114 Windows zero-day exploited by a Russian cyberespionage campaign; researchers there name the group behind it "Sandworm Team" after references to the novel Dune found in its malware.
• 2016-01-07Hultquist authors the iSight Partners report "Sandworm Team and the Ukrainian Power Authority Attacks," tying Sandworm to a December 2015 attack that cut power in Ukraine.
• 2016FireEye acquires iSight Partners; Hultquist continues threat intelligence work at FireEye.
• 2019As FireEye's Director of Intelligence Analysis, Hultquist is a public commentator on FireEye's research into the Chinese hacking group APT41.
• 2022As Mandiant's Vice President of Intelligence Analysis, Hultquist provides public analysis of the Sandworm-linked "Industroyer2" attack targeting Ukraine's power grid.
• 2022Google completes its acquisition of Mandiant.
• 2025-09As Chief Analyst of Google Threat Intelligence Group (GTIG), Hultquist comments publicly on the BRICKSTORM Chinese cyberespionage campaign.