A Comparative Forensic Analysis of Unit 26165 and Unit 74455 Cyber Operations on IT and OT Environments Using 2S Matrix Framework

This paper presents a comparative forensic analysis of two Russian state-linked threat groups - Unit 26165 (APT28) and Unit 74455 (Sandworm) - across six publicly documented incidents spanning information-technology (IT) and operational-technology (OT) environments. This research examines and compares IT versus OT escalation pathways of the two entities. MITRE ATT&CK (Enterprise and ICS) is used to normalize technique-level evidence. The 2S Matrix Framework is applied to capture operational tempo (Surface/Spread vs Stealth/Strike) and reconstruct attack pathways. The analysis shows that APT28 operates as an identity-centric espionage actor, emphasizing credential access and mailbox/OAuth governance to sustain low-noise collection, whereas Sandworm coordinates protocol-aware actions (e.g., IEC-104/61850 command messages), scheduled triggers, and recovery inhibitors to produce physical effects in OT. We distill phase-aware detection points for each domain: in enterprise, rule and token governance, outbound SMB controls, and identity telemetry; in OT, protocol allow-listing at master stations, relay/workflow safeguards, and monitoring for timed command sequences. The findings reveal distinct differences in targeting, persistence techniques, and strategic objectives, offering a deeper understanding of Russian gangs’ cyber-attacks on IT and OT systems and their impact on critical infrastructures.